@particle-academy/youtube-js 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -4,6 +4,55 @@ All notable changes to `@particle-academy/youtube-ui`,
 `@particle-academy/youtube-js`, `particle-academy/youtube-php` and
 `fancy-youtube`.
 
+## [0.2.2] — 2026-09-06
+
+### Changed
+
+- **Published through npm Trusted Publishing, so these packages now carry PROVENANCE.**
+
+Every earlier release went out under a scope-wide npm token. This one is
+published by an OIDC exchange from the release workflow itself, and npm records
+which workflow in which repository built it.
+`npm view @particle-academy/youtube-ui@0.2.2` shows the attestation; releases before
+this one have none.
+
+What it buys a consumer: the tarball on the registry can be tied to a public
+commit and a public workflow run, rather than to whoever held a token. What it
+does not buy: nothing about the code changed, and the runtime behaviour of all
+four packages is identical to 0.2.1.
+
+- **`repository.directory` in the npm packages.**
+
+`@particle-academy/youtube-ui` and `@particle-academy/youtube-js` live at
+`packages/ui` and `packages/js` inside the provider repo. npm's `repository`
+field now says so, which makes the "Repository" link on each package page point
+at the package rather than at the repository root.
+
+## [0.2.1] — 2026-08-24
+
+### Fixed
+
+- **`@particle-academy/youtube-js` now accepts a RANGE of `@particle-academy/youtube-ui`, not one exact version.**
+
+It peer-depended on `@particle-academy/youtube-ui` at exactly the release it shipped with. That is the
+strict form of the thing the kit's own rule forbids — a first-party sibling gets
+a range — and the same block applied the rule correctly to its other two
+dependencies. It was this one pair that slipped.
+
+What it cost: ship `@particle-academy/youtube-ui` with a fixed help string and every consumer on the
+previous `@particle-academy/youtube-js` had an **unmet peer**, which npm 7+ errors on. A documentation
+patch could not be delivered without a matching runtime release, and a routine
+`npm update` that moved the ui package alone broke the install.
+
+The coupling is real and is not being loosened away. The ui package emits the
+config schema and the js package implements against it, so a ui that adds a
+field to a js that ignores it is silently wrong. But a PATCH is non-additive by
+definition and a MINOR is where a field can appear — so `>=0.2.1 <0.3.0` is the
+coupling that actually exists rather than the strictest one expressible.
+
+Nothing else changed. `particle-academy/youtube-php` and `fancy-youtube` are unaffected; neither has an
+equivalent edge.
+
 ## [0.2.0] — 2026-08-24
 
 ### Added
@@ -62,3 +111,4 @@ accepts for modifying playlist contents. YouTube has no test estate, and
 
 [0.1.0]: https://github.com/Fancy-Friends/youtube/releases/tag/v0.1.0
 [0.2.0]: https://github.com/Fancy-Friends/youtube/releases/tag/v0.2.0
+[0.2.1]: https://github.com/Fancy-Friends/youtube/releases/tag/v0.2.1

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@particle-academy/youtube-js",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "YouTube for Node — the service descriptor, its faker, its webhook verification, and one function per operation. Plain HTTP on @particle-academy/fancy-connector-core; no vendor SDK.",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Fancy-Friends/youtube.git"
+    "url": "git+https://github.com/Fancy-Friends/youtube.git",
+    "directory": "packages/js"
   },
   "homepage": "https://github.com/Fancy-Friends/youtube#readme",
   "bugs": "https://github.com/Fancy-Friends/youtube/issues",
@@ -52,7 +53,7 @@
   },
   "peerDependencies": {
     "@particle-academy/fancy-flow": ">=0.47.1 <2.0",
-    "@particle-academy/youtube-ui": "0.2.0"
+    "@particle-academy/youtube-ui": ">=0.2.0 <0.3.0"
   },
   "peerDependenciesMeta": {
     "@particle-academy/fancy-flow": {