@wefunder/sdk 0.1.0-beta.1 → 0.1.0-beta.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -8,10 +8,11 @@ Official TypeScript SDK for the [Wefunder API](https://docs.wefunder.com/api-ref
8
8
  > stabilize. Feedback welcome.
9
9
 
10
10
  ```bash
11
- npm install @wefunder/sdk
11
+ npm install @wefunder/sdk@beta
12
12
  ```
13
13
 
14
- Node 18+ (uses the global `fetch`). ESM and CommonJS both supported.
14
+ While in beta, releases publish to the `@beta` dist-tag (npm reserves `latest` for the
15
+ eventual stable release). Node 20+ (uses the global `fetch`). ESM and CommonJS both supported.
15
16
 
16
17
  ### Scope & versioning
17
18
 
@@ -219,3 +220,29 @@ so the public-tier definition can't drift between the two repos. CI's
219
220
  `generated code matches spec` job verifies `src/generated` matches the committed spec;
220
221
  it cannot reach the private canonical swagger, so run `sync-spec` before cutting a
221
222
  release. (`npm test` stays hermetic.)
223
+
224
+ ### Releasing (maintainers)
225
+
226
+ Releases publish from CI with provenance — no manual `npm publish` or OTP. Bump the
227
+ version and push the tag; the `Release` workflow (`.github/workflows/release.yml`,
228
+ triggered on `v*` tags) runs the `prepublishOnly` gate and publishes:
229
+
230
+ ```bash
231
+ git checkout main && git pull # clean tree, on main
232
+ npm version prerelease --preid beta # 0.1.0-beta.N → N+1, commits + tags v0.1.0-beta.N+1
233
+ git push --follow-tags # pushes the commit + tag → CI publishes
234
+ ```
235
+
236
+ The workflow verifies the tag matches `package.json`, then publishes — prerelease
237
+ versions (e.g. `0.1.0-beta.N`) to the **`beta`** dist-tag (npm requires an explicit tag
238
+ for prereleases), stable versions to `latest`. For a stable release use
239
+ `npm version patch|minor|major` (no `--preid`).
240
+
241
+ **Auth is npm Trusted Publishing (OIDC) — no token to store.** npm exchanges the
242
+ workflow's GitHub OIDC token for a short-lived credential at publish time, and
243
+ provenance is generated automatically (verified-build badge on npmjs.com).
244
+
245
+ **One-time setup:** on npmjs.com, `@wefunder/sdk` → **Settings → Trusted Publishing →
246
+ GitHub Actions**, with org/user `Wefunder`, repository `wefunder-node`, workflow
247
+ `release.yml` (leave Environment blank). No repo secret needed. (Requires this public
248
+ repo + public package — both true.)