@ssheleg/xr-dev 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the project uses
 [semantic versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.3.1 — 2026-09-21
+
+- Make GitHub OIDC the explicit npm publishing path, without a stored npm token.
+- Normalize npm repository metadata and document tag-triggered releases, initial trust setup and recovery.
+
 ## 0.3.0 — 2026-09-21
 
 - Add quest-lifecycle: a portable product-stage map with proactive next actions, engine selection, immersive-design acceptance and evidence gates.

package/README.md

@@ -91,6 +91,13 @@ claude plugin validate plugins/xr-dev --strict
 [Test evaluation documentation](test/evals/README.md) separates scenario definitions,
 isolated model planning probes, runtime routing and device/product evidence.
 
+## Releases
+
+Push a `vX.Y.Z` tag after its versioned commit reaches the default branch. GitHub
+Actions validates the pack, creates the GitHub release and publishes to npm with
+provenance through trusted publishing. Ordinary branch pushes run checks only.
+See [release setup and recovery](docs/RELEASING.md).
+
 ## License
 
 MIT for this pack. Primary documentation is linked and dated; third-party tools,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/xr-dev",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Seven skills for the Meta Quest product lifecycle: platform and engine discovery, immersive design, native OpenXR, Kotlin Spatial and hybrid apps, WebXR/PWA, rendering experiments, tool and source discovery, Store submission, monetization, launch assets and post-launch operation. Agents receive stage-specific next actions, evidence gates and fallbacks when tools or devices are absent. Engine specialists remain separate; live requirements are verified against current Meta documentation.",
   "bin": {
     "xr-dev": "bin/xr-dev.js"
@@ -16,7 +16,10 @@
     "CHANGELOG.md",
     "SECURITY.md"
   ],
-  "repository": "github:ssheleg/xr-dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ssheleg/xr-dev.git"
+  },
   "homepage": "https://skills.sshlg.me/skills/xr-dev/",
   "license": "MIT",
   "author": {

package/plugins/xr-dev/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "xr-dev",
   "displayName": "XR Dev",
   "description": "Seven skills for the Meta Quest product lifecycle: platform and engine discovery, immersive design, native OpenXR, Kotlin Spatial and hybrid apps, WebXR/PWA, rendering experiments, tool and source discovery, Store submission, monetization, launch assets and post-launch operation. Agents receive stage-specific next actions, evidence gates and fallbacks when tools or devices are absent. Engine specialists remain separate; live requirements are verified against current Meta documentation.",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/xr-dev/skills/quest-lifecycle/SKILL.md

@@ -14,7 +14,7 @@ description: >-
 license: MIT
 compatibility: Any agent with file reading can plan inline. Writing the lifecycle record needs file access; current research needs network; build, device and Dashboard verification need their actual tools and accounts. Missing capabilities remain explicitly unverified.
 metadata:
-  version: "0.3.0"
+  version: "0.3.1"
 ---
 
 # Quest product lifecycle

package/plugins/xr-dev/skills/quest-native/SKILL.md

@@ -16,7 +16,7 @@ description: >-
 license: MIT
 compatibility: Any agent can read this workflow. Live source checks need network; build, device, profiling and Store actions need the named installed tools and accounts. Missing capabilities use the inline fallback and leave dependent checks unverified.
 metadata:
-  version: "0.3.0"
+  version: "0.3.1"
 ---
 
 # Native OpenXR on Horizon OS

package/plugins/xr-dev/skills/quest-perf/SKILL.md

@@ -16,7 +16,7 @@ description: >-
 license: MIT
 compatibility: Any agent can read this workflow. Live source checks need network; build, device, profiling and Store actions need the named installed tools and accounts. Missing capabilities use the inline fallback and leave dependent checks unverified.
 metadata:
-  version: "0.3.0"
+  version: "0.3.1"
 ---
 
 # Quest performance: the budget, the lie, and the capture

package/plugins/xr-dev/skills/quest-spatial/SKILL.md

@@ -16,7 +16,7 @@ description: >-
 license: MIT
 compatibility: Any agent can read this workflow. Live source checks need network; build, device, profiling and Store actions need the named installed tools and accounts. Missing capabilities use the inline fallback and leave dependent checks unverified.
 metadata:
-  version: "0.3.0"
+  version: "0.3.1"
 ---
 
 # Meta Spatial SDK: the Android lane onto Horizon OS

package/plugins/xr-dev/skills/quest-store/SKILL.md

@@ -14,7 +14,7 @@ description: >-
 license: MIT
 compatibility: Any agent can read this workflow. Live source checks need network; build, device, profiling and Store actions need the named installed tools and accounts. Missing capabilities use the inline fallback and leave dependent checks unverified.
 metadata:
-  version: "0.3.0"
+  version: "0.3.1"
 ---
 
 # Shipping to the Meta Horizon Store

package/plugins/xr-dev/skills/quest-tooling/SKILL.md

@@ -16,7 +16,7 @@ description: >-
 license: MIT
 compatibility: Any agent can read this workflow. Live source checks need network; build, device, profiling and Store actions need the named installed tools and accounts. Missing capabilities use the inline fallback and leave dependent checks unverified.
 metadata:
-  version: "0.3.0"
+  version: "0.3.1"
 ---
 
 # The Quest toolchain: one CLI, two interfaces, one channel per agent

package/plugins/xr-dev/skills/quest-webxr/SKILL.md

@@ -15,7 +15,7 @@ description: >-
 license: MIT
 compatibility: Any agent can read this workflow. Live source checks need network; build, device, profiling and Store actions need the named installed tools and accounts. Missing capabilities use the inline fallback and leave dependent checks unverified.
 metadata:
-  version: "0.3.0"
+  version: "0.3.1"
 ---
 
 # WebXR and PWAs on Horizon OS