@miketromba/ploof 0.1.0 → 0.1.2

package/README.md

@@ -1,9 +1,5 @@
 <p align="center">
-  <strong>Ploof</strong>
-</p>
-
-<p align="center">
-  AI asset generation from the command line.
+  <img src="assets/brand/ploof-banner.png" alt="Ploof - AI asset generation from the command line." width="100%" />
 </p>
 
 <p align="center">
@@ -273,6 +269,29 @@ PLOOF_OPENAI_LIVE_MODEL=gpt-image-1
 PLOOF_OPENAI_LIVE_SIZE=1024x1024
 ```
 
+## Publishing
+
+Local release verification stops at packaging:
+
+```bash
+bun run release
+```
+
+Publishing should happen from GitHub Actions by pushing a `v*` tag. The npm
+package must have a Trusted Publisher configured with:
+
+| Field | Value |
+| --- | --- |
+| Provider | GitHub Actions |
+| Organization or user | `miketromba` |
+| Repository | `ploof` |
+| Workflow filename | `publish.yml` |
+| Environment | blank |
+| Allowed action | `npm publish` |
+
+Do not publish from a local terminal unless intentionally doing a manual
+emergency release.
+
 ## License
 
 MIT

package/SPEC.md

@@ -51,9 +51,21 @@ Conventions to preserve:
 - Published package runs on Node 18+ and does not require Bun.
 - Published files are constrained to runtime artifacts, README, LICENSE, spec, and skill files.
 - GitHub Actions CI runs typecheck, tests, and build.
-- GitHub Actions publish runs on `v*` tags and supports npm trusted publishing/OIDC.
+- GitHub Actions publish runs on `v*` tags through npm trusted publishing/OIDC.
 - Human-readable output in TTY, compact output when piped, JSON/JSONL for agents and scripts.
 
+NPM trusted publisher settings for `@miketromba/ploof`:
+
+- Provider: GitHub Actions.
+- Organization or user: `miketromba`.
+- Repository: `ploof`.
+- Workflow filename: `publish.yml`.
+- Environment: blank.
+- Allowed action: `npm publish`.
+
+Local release verification must stop at `npm pack --dry-run`; do not run local
+`npm publish` for normal releases.
+
 ## Core Goals
 
 1. Authenticate with multiple asset generation providers.