@pwguler/pi-pengepul-provider 0.2.2 → 0.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +43 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -91,6 +91,49 @@ npx tsc --noEmit
|
|
|
91
91
|
bun scripts/e2e-live.ts # live e2e against a running relay; sends one tiny completion
|
|
92
92
|
```
|
|
93
93
|
|
|
94
|
+
## Releasing
|
|
95
|
+
|
|
96
|
+
Releases publish from CI on a version tag. Bump, tag, push:
|
|
97
|
+
|
|
98
|
+
```sh
|
|
99
|
+
VERSION=0.2.3
|
|
100
|
+
npm version "$VERSION" --no-git-tag-version
|
|
101
|
+
git add package.json package-lock.json
|
|
102
|
+
git commit -m "chore(release): v$VERSION"
|
|
103
|
+
git tag "v$VERSION"
|
|
104
|
+
git push origin main --tags
|
|
105
|
+
```
|
|
106
|
+
|
|
107
|
+
`.github/workflows/publish.yml` then runs the full test suite and refuses the
|
|
108
|
+
release unless the tag matches `package.json`, the tagged commit is on `main`,
|
|
109
|
+
and the version is not already on the registry. It publishes with a provenance
|
|
110
|
+
attestation linking the tarball to this repository and commit.
|
|
111
|
+
|
|
112
|
+
Publishing needs a repository secret named `NPM_TOKEN`, holding a granular
|
|
113
|
+
access token:
|
|
114
|
+
|
|
115
|
+
- **Permissions**: *Read and write*. *Read-only*, and the *stage only* variant
|
|
116
|
+
of read and write, cannot run `npm publish`.
|
|
117
|
+
- **Packages and scopes**: *All packages*.
|
|
118
|
+
- **Bypass two-factor authentication**: ticked. A token that prompts for an OTP
|
|
119
|
+
cannot publish unattended.
|
|
120
|
+
- **Expiration**: whatever you will actually remember to rotate. When it lapses,
|
|
121
|
+
the release fails at the publish step.
|
|
122
|
+
|
|
123
|
+
npm removed classic tokens in November 2025, so granular is the only kind that
|
|
124
|
+
exists. On the token form, leave **Organizations** at *No access*: this package
|
|
125
|
+
lives in a user scope (`@pwguler`), not an organization, so a personal account
|
|
126
|
+
has nothing to select there. Choosing *Only select packages and scopes* instead
|
|
127
|
+
of *All packages* asks for a scope selection that such an account cannot
|
|
128
|
+
satisfy.
|
|
129
|
+
|
|
130
|
+
Trusted publishing (OIDC) is the alternative: no secret to store or rotate, and
|
|
131
|
+
provenance is generated automatically. It needs a one-time configuration on the
|
|
132
|
+
package's npm settings page instead of a token.
|
|
133
|
+
|
|
134
|
+
`.github/workflows/ci.yml` runs typecheck and tests on pull requests and pushes
|
|
135
|
+
to `main`, and is the same gate the publish job depends on.
|
|
136
|
+
|
|
94
137
|
## License
|
|
95
138
|
|
|
96
139
|
MIT
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@pwguler/pi-pengepul-provider",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.3",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "pi custom provider for pengepul, a local relay that pools your Claude/Codex subscriptions. Connects pi to http://127.0.0.1:8317 over the native Anthropic Messages and OpenAI Chat Completions wires.",
|
|
6
6
|
"license": "MIT",
|