@treeseed/dsh-chapters 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/development.md +17 -0
- package/package.json +1 -1
package/docs/development.md
CHANGED
|
@@ -140,6 +140,23 @@ Re-record discipline (learned the hard way 2026-09-22/23):
|
|
|
140
140
|
the deterministic + live ledgers own that transport).
|
|
141
141
|
Both ledgers together are the coverage claim; neither alone is honest.
|
|
142
142
|
|
|
143
|
+
### Release status (measured 2026-09-25)
|
|
144
|
+
|
|
145
|
+
`@treeseed/dsh-chapters@0.1.0` is LIVE on npmjs.org — published manually from
|
|
146
|
+
the CI-verified tag (`npm publish --access public --provenance=false`; the
|
|
147
|
+
registry shasum matches the CI tree byte-for-byte, install-smoke green).
|
|
148
|
+
Manual because the Production environment's NPM_TOKEN cannot CREATE a
|
|
149
|
+
package it is not scoped to (E404 = granular-token scope limitation, not a
|
|
150
|
+
secret problem) — and that whole class of auth is now gone: **CI publishes
|
|
151
|
+
run on npm TRUSTED PUBLISHING (OIDC)**. release.yml carries no token;
|
|
152
|
+
setup-node gets `registry-url` but never a `token:` (any `_authToken` in an
|
|
153
|
+
npmrc overrides the OIDC path), `id-token: write` is the credential, and the
|
|
154
|
+
npm side must register this package's Trusted Publisher as: repo
|
|
155
|
+
`treeseed-ai/dsh-chapters`, branch `main`, workflow `release.yml`,
|
|
156
|
+
environment `Production`. Prerelease versions publish under a matching
|
|
157
|
+
dist-tag so 'latest' stays stable. `0.1.1` is the first OIDC + provenance
|
|
158
|
+
ship; `0.1.0` itself carries no attestation.
|
|
159
|
+
|
|
143
160
|
### Hosted CI (`.github/workflows/`, wired + dress-rehearsed 2026-09-23)
|
|
144
161
|
|
|
145
162
|
- **`ci.yml`** — two jobs. `test`: `npm ci` (all deps public on
|