@liminis/editor 0.1.0-rc.2 → 0.1.1

package/README.md

@@ -28,16 +28,14 @@ travelled with the code, are recorded in [`docs/provenance.md`](./docs/provenanc
 
 ## Install
 
-> **This package is published as a prerelease.** `0.1.0-rc.1` is on npm under the
-> `next` tag, so `pnpm add @liminis/editor` resolves nothing — ask for the tag:
->
-> ```bash
-> pnpm add @liminis/editor@next
-> ```
->
-> The prerelease exists to prove the registry install path, which nothing had
-> exercised: both consuming applications resolved this package locally. `latest`
-> stays unset until `0.1.0`.
+```bash
+pnpm add @liminis/editor
+```
+
+> **This is `0.x`.** Minor versions may contain breaking changes; patch versions
+> will not. The seven declared subpath exports are the public API — anything
+> reachable by a deeper path is private and may move without notice. Breaking
+> changes are listed in the changelog with a migration note.
 
 React and Lexical are **peer dependencies**, so your app resolves exactly one
 copy of each. Two React copies produce `Invalid hook call`; two Lexical copies
@@ -265,7 +263,7 @@ inert).
 
 ## Consuming it
 
-The registry is now the normal route (`pnpm add @liminis/editor@next`). The
+The registry is the normal route (`pnpm add @liminis/editor`). The
 **packed tarball** below remains the way to consume an unreleased change — a
 local build, or a commit that has not been tagged:
 

package/docs/decisions/adr-078.md

@@ -86,6 +86,40 @@ that exists but contains no class-bearing source.
 `publishConfig` makes that whole class of problem not arise. The cost is that
 the built path is exercised only in CI — which is what SC-005 mandates anyway.
 
+> **Amended 2026-08-16 — the `publishConfig` mechanism is reversed as of
+> 0.1.1.** It does not work, and it shipped a broken `0.1.0`.
+>
+> `publishConfig` **manifest-field** overrides (`main`, `types`, `exports`) are
+> a pnpm and yarn feature. npm honours `publishConfig` only for *config* values
+> — `access`, `registry`, `tag` — and ignores field overrides entirely.
+> `.github/workflows/publish.yml` publishes with `npm publish`, so the swap to
+> `dist/` never happened: `0.1.0` went to the registry declaring
+> `"main": "./src/index.ts"` while `files` shipped only `dist/`. Every entry
+> point resolved to a file that was not in the tarball, and the package could
+> not be imported at all.
+>
+> This survived a verification pass that was, in itself, correct and thorough.
+> `scripts/verify-package.mjs` asserted that the packed manifest pointed at
+> `dist/` and that each target existed — but it packed with **pnpm** while the
+> release packed with **npm**. It validated a tarball no consumer would ever
+> receive. The lesson is narrower and more useful than "test more": *verify the
+> artifact the release actually produces.*
+>
+> The entry points now live in the checked-in manifest as `dist/` paths, with
+> no pack-time rewriting by anyone, and `verify-package.mjs` packs with npm and
+> additionally asserts the packed entry points are byte-identical to the
+> checked-in ones — so a client that rewrites them fails too.
+>
+> **What this costs is exactly what the decision above was buying.** An
+> in-workspace consumer resolving `@liminis/editor` no longer lands on raw
+> TypeScript, so the Tailwind `@source` directive and the bundler
+> externalization exclusion described above must name the installed package
+> rather than a sibling `src/` tree. That cost is now acceptable because the
+> monorepo copy is being removed in favour of the published package
+> (verveguy/liminis#1009) — the in-workspace consumer this protected is going
+> away. The rest of the decision — the non-bundling `tsc` emit, `sideEffects`,
+> the vendored wiki-link fix — is unaffected.
+
 `private: true` is kept: publishing is out of scope for #940, and `private`
 blocks `publish` without blocking `pack`.
 
@@ -96,8 +130,9 @@ blocks `publish` without blocking `pack`.
 > package is private. The guard is now `prepublishOnly` →
 > `scripts/guard-publish.mjs`, which refuses unless `LIMINIS_ALLOW_PUBLISH=1`
 > is set — a script rather than a flag precisely so that it can be tested, and
-> it is, in `tests/package-manifest-contract.test.ts`. The rest of this ADR is
-> unaffected: `publishConfig` and the non-bundling `tsc` emit stand as decided.
+> it is, in `tests/package-manifest-contract.test.ts`. The non-bundling `tsc`
+> emit stands as decided. (This amendment originally said `publishConfig` stood
+> too. It does not — see the amendment above it, added later the same day.)
 
 ### 3. `mdast-util-wiki-link` is vendored, not merely un-patched.
 

package/package.json

@@ -1,72 +1,56 @@
 {
   "name": "@liminis/editor",
-  "version": "0.1.0-rc.2",
+  "version": "0.1.1",
   "//publishing": "Publishing is deliberate, never incidental. `private: true` was this package's guard until verveguy/liminis-editor#39 took the publish decision; it is gone because that decision was taken, not because it was tidied away. The guard is now `prepublishOnly` -> scripts/guard-publish.mjs, which refuses unless LIMINIS_ALLOW_PUBLISH=1 is set explicitly. That variable is set at step scope in .github/workflows/publish.yml and nowhere else, so a release is the only path that publishes. Note that `npm publish --dry-run` does NOT report a private package as blocked (npm 10.8.2), which is why the guard is a script rather than a flag.",
   "license": "MIT",
   "description": "Lexical-based markdown WYSIWYG editor with mdast round-trip and a host-injection seam",
+  "keywords": [
+    "markdown",
+    "markdown-editor",
+    "wysiwyg",
+    "rich-text",
+    "editor",
+    "lexical",
+    "react",
+    "mdast",
+    "round-trip",
+    "annotations"
+  ],
   "//packageManager": "Not cosmetic. This field used to live in the monorepo root manifest and did not travel with the package, so `pnpm/action-setup` had no version to read and CI failed before installing anything. It is also what pins the pnpm that resolves the lockfile.",
   "packageManager": "pnpm@10.33.0",
   "type": "module",
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "//entrypoints": "These point at dist/ here, in the checked-in manifest, and must stay that way. They lived under `publishConfig` until 0.1.1 so that in-workspace consumers could resolve raw TypeScript, and that silently shipped a broken 0.1.0: `publishConfig` manifest-field overrides (main/types/exports) are a pnpm and yarn feature, and npm honours `publishConfig` only for config values like access, registry and tag. `npm publish` therefore published src/ paths while `files` shipped only dist/, so every entry point resolved to a file that was not in the tarball. What is published is now exactly what is written here, and scripts/verify-package.mjs packs with the same client that publishes so the two cannot diverge again. See docs/decisions/adr-078.md.",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "types": "./src/index.ts",
-      "default": "./src/index.ts"
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     },
     "./markdown": {
-      "types": "./src/markdown.ts",
-      "default": "./src/markdown.ts"
+      "types": "./dist/markdown.d.ts",
+      "default": "./dist/markdown.js"
     },
     "./annotations": {
-      "types": "./src/annotations.ts",
-      "default": "./src/annotations.ts"
+      "types": "./dist/annotations.d.ts",
+      "default": "./dist/annotations.js"
     },
     "./headless": {
-      "types": "./src/headless.ts",
-      "default": "./src/headless.ts"
+      "types": "./dist/headless.d.ts",
+      "default": "./dist/headless.js"
     },
     "./contract": {
-      "types": "./src/contract.ts",
-      "default": "./src/contract.ts"
+      "types": "./dist/contract.d.ts",
+      "default": "./dist/contract.js"
     },
     "./nodes": {
-      "types": "./src/nodes.ts",
-      "default": "./src/nodes.ts"
+      "types": "./dist/nodes.d.ts",
+      "default": "./dist/nodes.js"
     },
-    "./styles.css": "./src/styles.css"
+    "./styles.css": "./dist/styles.css"
   },
   "publishConfig": {
-    "access": "public",
-    "main": "./dist/index.js",
-    "types": "./dist/index.d.ts",
-    "exports": {
-      ".": {
-        "types": "./dist/index.d.ts",
-        "default": "./dist/index.js"
-      },
-      "./markdown": {
-        "types": "./dist/markdown.d.ts",
-        "default": "./dist/markdown.js"
-      },
-      "./annotations": {
-        "types": "./dist/annotations.d.ts",
-        "default": "./dist/annotations.js"
-      },
-      "./headless": {
-        "types": "./dist/headless.d.ts",
-        "default": "./dist/headless.js"
-      },
-      "./contract": {
-        "types": "./dist/contract.d.ts",
-        "default": "./dist/contract.js"
-      },
-      "./nodes": {
-        "types": "./dist/nodes.d.ts",
-        "default": "./dist/nodes.js"
-      },
-      "./styles.css": "./dist/styles.css"
-    }
+    "access": "public"
   },
   "files": [
     "dist",