create-convex-monorepo 0.2.0 → 0.2.1

package/CONTRIBUTING.md

@@ -46,7 +46,7 @@ Use Conventional Commits for commits and PR titles. For example, `feat(cli): ini
 
 Use `fix:` for a patch, `feat:` for a minor, and `!` for a breaking change, such as `feat(cli)!: change application selection flags`. Explain breaking changes and migration steps in the PR body. These rules also apply before v1.0, so a breaking change from 0.1.0 proposes 1.0.0. `perf:` also triggers a patch; other ordinary maintenance commits do not trigger a release alone.
 
-Release-please maintains a PR with the next version and changelog. Do not add changeset files or manually bump versions for normal changes. Maintainers review and merge the release PR to create a GitHub release, which starts the npm publishing workflow. It verifies the release commit and publishes the tested tarball using a bootstrap token for the first release and trusted publishing afterward. See [release setup and publishing](docs/releases.md).
+Release-please maintains a PR with the next version and changelog. Do not add changeset files or manually bump versions for normal changes. Maintainers review and merge the release PR to create a GitHub release, which starts the npm publishing workflow. It verifies the release commit and publishes the tested tarball using npm trusted publishing without a stored npm token. See [release setup and publishing](docs/releases.md).
 
 ## Reporting problems
 

package/README.md

@@ -24,7 +24,7 @@ npx create-convex-monorepo@latest
 
 Both commands run the same CLI. You can also install it globally with `npm install --global create-convex-monorepo` and run `create-convex-monorepo` directly. Running through npx does not change the generated workspace's package manager, which is pnpm.
 
-The first npm publication is being prepared. These registry commands become available after that release is published. Contributors can run the checkout with `pnpm dev`; see [CONTRIBUTING.md](CONTRIBUTING.md).
+Contributors can run the checkout with `pnpm dev`; see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## Interactive usage
 

package/docs/releases.md

@@ -1,6 +1,6 @@
 # Releases
 
-This repository uses Conventional Commits and release-please for versions, changelogs, release PRs, and GitHub releases. GitHub Actions tests and publishes the release tarball to npm. The first publication uses a bootstrap token; subsequent releases use trusted publishing. This follows the publishing model in [convex-cloudflare-email](https://github.com/adamtrip-solutions/convex-cloudflare-email/blob/main/.github/workflows/release.yml).
+This repository uses Conventional Commits and release-please for versions, changelogs, release PRs, and GitHub releases. GitHub Actions tests and publishes the release tarball to npm. The first publication used a bootstrap token. The workflow now uses trusted publishing without a token fallback. This follows the publishing model in [convex-cloudflare-email](https://github.com/adamtrip-solutions/convex-cloudflare-email/blob/main/.github/workflows/release.yml).
 
 ## Version policy
 
@@ -15,7 +15,7 @@ This repository uses Conventional Commits and release-please for versions, chang
 
 A `BREAKING CHANGE:` commit footer also requests a major bump. Explain migration steps when using it. The two pre-major downgrade options are explicitly disabled, so breaking changes still request a major before 1.0. For several commits, the largest requested bump wins. This follows the [release-please versioning strategy](https://github.com/googleapis/release-please/blob/main/src/versioning-strategies/default.ts).
 
-The manifest records 0.1.0 as the existing baseline. `bootstrap-sha` points to the last committed v0.1 work, `0373d22b000dc9cba036a1d2f1cff689b217fd8b`, so initial history is not replayed as new features. This does not publish 0.1.0 or create a historical release. After the first automated release, release-please uses release history. See its [manifest documentation](https://github.com/googleapis/release-please/blob/main/docs/manifest-releaser.md).
+The initial manifest recorded 0.1.0 as the existing baseline. `bootstrap-sha` points to the last committed v0.1 work, `0373d22b000dc9cba036a1d2f1cff689b217fd8b`, so initial history is not replayed as new features. This does not publish 0.1.0 or create a historical release. After the first automated release, release-please uses release history. See its [manifest documentation](https://github.com/googleapis/release-please/blob/main/docs/manifest-releaser.md).
 
 ## GitHub configuration
 
@@ -24,36 +24,29 @@ The public repository is `adamtrip-solutions/create-convex-monorepo`. The packag
 - Use `main` as the release branch. Enable Actions and allow GitHub Actions to create pull requests.
 - Enable squash merging with the PR title as the commit title. Require the Conventional PR title check and `CI passed` before merging.
 - Create a GitHub environment named `npm`. Restrict deployments to tags matching `v*`. Protect release tags against updates and deletion.
-- Configure `NPM_BOOTSTRAP_TOKEN` in the `npm` environment before the first release, or configure npm trusted publishing if the package already exists. No publishing-enable variable is required.
+- Configure npm trusted publishing as described below. No npm secret or publishing-enable variable is required.
 
 The release workflow uses `GITHUB_TOKEN` by default. GitHub may require approval before running CI on a bot-created release PR. An optional `RELEASE_PLEASE_TOKEN` with repository contents, issues and pull-request write permissions can avoid that interruption. The npm dispatch step always uses `GITHUB_TOKEN` with `actions: write`; it does not require Actions permission on the optional token. [GitHub token event rules](https://docs.github.com/en/actions/concepts/security/github_token).
 
 ## First npm publication
 
-1. Use your existing npm account with a verified email and two-factor authentication. The package is unscoped, so a separate npm organization is not required.
-2. Create a short-lived granular npm token with Read and write package permissions that allow creation of `create-convex-monorepo`. Enable Bypass two-factor authentication for this first unattended publish. A token limited to the existing `convex-cloudflare-email` package cannot create this new package.
-3. Save it as `NPM_BOOTSTRAP_TOKEN` in this repository's [npm environment](https://github.com/adamtrip-solutions/create-convex-monorepo/settings/environments). Use GitHub's secret UI, or run the following command in your own terminal and paste the token at its hidden prompt:
+Version 0.2.0 created the package through GitHub Actions using `NPM_BOOTSTRAP_TOKEN`. The workflow no longer reads that secret. Subsequent releases authenticate through npm trusted publishing.
 
-   ```sh
-   gh secret set NPM_BOOTSTRAP_TOKEN --env npm --repo adamtrip-solutions/create-convex-monorepo
-   ```
+## Trusted publisher configuration
 
-   GitHub secrets are write-only; a stored token in another repository cannot be read back and copied. Do not paste it into chat or commit it.
+In the npm package settings, add a GitHub Actions trusted publisher with these exact values:
 
-4. Merge the first release-please PR after CI passes. The release workflow creates the version tag and dispatches **Publish npm package**. It tests the release commit and automatically publishes the verified archive with provenance. There is no local `npm publish` or archive download step.
-5. After that first publication succeeds, configure a GitHub Actions trusted publisher in the npm package settings:
+| Field             | Value                       |
+| ----------------- | --------------------------- |
+| Organization/user | `adamtrip-solutions`        |
+| Repository        | `create-convex-monorepo`    |
+| Workflow filename | `publish.yml`               |
+| Environment       | `npm`                       |
+| Allowed action    | Enable direct `npm publish` |
 
-   | Field             | Value                                                   |
-   | ----------------- | ------------------------------------------------------- |
-   | Organization/user | `adamtrip-solutions`                                    |
-   | Repository        | `create-convex-monorepo`                                |
-   | Workflow filename | `publish.yml`                                           |
-   | Environment       | `npm`                                                   |
-   | Allowed action    | Enable direct `npm publish`, not only staged publishing |
+The workflow requests a short-lived OIDC credential from GitHub. npm verifies the repository, workflow, and environment against this configuration. There is no stored npm token in the publishing step. [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/).
 
-6. Delete the `NPM_BOOTSTRAP_TOKEN` GitHub secret and revoke that npm token. Subsequent releases use OIDC without a stored npm credential. Once OIDC is configured, npm can require two-factor authentication and disallow token-based publishing.
-
-The bootstrap token is available only to the final publish step, after all validation jobs pass. Current npm documentation requires the package to exist before configuring its trusted publisher; the bootstrap token lets CI create it. [Token setup](https://docs.npmjs.com/creating-and-viewing-access-tokens/), [trusted publisher configuration](https://docs.npmjs.com/trusted-publishers/).
+Verify the migration with a new release through the workflow. Retrying an already published version skips publication and does not test authentication. After an OIDC publication succeeds, delete the old GitHub bootstrap secret and revoke the corresponding npm token. If that token is shared with another package, migrate that package or replace its credential before revoking it.
 
 ## Automated release flow
 
@@ -75,4 +68,4 @@ gh workflow run publish.yml --repo adamtrip-solutions/create-convex-monorepo --r
 
 Select the tag in the Actions UI when triggering manually. Running from a branch is rejected. If npm already contains that exact tarball, the publish step skips it. A version with different contents fails explicitly; release a new version instead of moving tags or trying to overwrite npm history. If the workflow itself needs a code fix, include it in a new release because retries execute the workflow stored at the original tag.
 
-Normal changes do not need manual version edits. If the release PR stalls, inspect the workflow logs, token permissions and `autorelease` labels. Keep release-please's generated title and body intact. After the first successful npm publication, remove the prepublication notice in README.md.
+Normal changes do not need manual version edits. If the release PR stalls, inspect the workflow logs, token permissions and `autorelease` labels. Keep release-please's generated title and body intact.

package/docs/verification.md

@@ -75,4 +75,16 @@ Fresh review checked the release dispatch, provenance commit identity, bootstrap
 
 Compared both the local checkout and GitHub workflow of `adamtrip-solutions/convex-cloudflare-email`, whose first npm release workflow succeeded. Its publish step supports `NPM_BOOTSTRAP_TOKEN` for initial package creation. This repository now supports the same token-to-OIDC transition and no longer gates publishing behind `NPM_PUBLISHING_ENABLED`. The token is passed only to the final npm publish step. No secret values were read or transferred from the reference repository, and this package has not been published.
 
-A later Windows run exposed an intermittent cancellation failure: setup rejected on the child's abort error before the process closed, leaving the backend directory locked during cleanup. The regression test reproduced the early return locally. Setup now waits for the child close event before settling, preserving the original error. The corrected test and all 98 repository tests passed, together with typecheck, lint, formatting, build, and package smoke checks. Hosted Windows confirmation of this fix is pending.
+A later Windows run exposed an intermittent cancellation failure: setup rejected on the child's abort error before the process closed, leaving the backend directory locked during cleanup. The regression test reproduced the early return locally. Setup now waits for the child close event before settling, preserving the original error. The corrected test and all 98 repository tests passed, together with typecheck, lint, formatting, build, and package smoke checks. Hosted [CI run 34416758903](https://github.com/adamtrip-solutions/create-convex-monorepo/actions/runs/34416758903) confirmed the fix on Windows and passed every generated-project build.
+
+## First npm publication
+
+GitHub Actions [run 34417030866](https://github.com/adamtrip-solutions/create-convex-monorepo/actions/runs/34417030866) published `create-convex-monorepo@0.2.0` from release commit `406b6dec137ba521a23ebc6d78965f0373e1ba98`. The release ran all 98 tests on Windows and Linux, package smoke checks, and the complete generated-project build matrix before publishing the tested tarball. The registry reports `latest` as `0.2.0` and includes a provenance attestation.
+
+Registry checks ran outside the source checkout:
+
+- `pnpm create convex-monorepo@0.2.0 smoke --apps next,expo --auth clerk --example none --no-install --no-git` generated the blank workspace successfully.
+- `npx --yes create-convex-monorepo@0.2.0 --version` returned `0.2.0`, using both the default npm cache and a fresh cache.
+- `npx --yes create-convex-monorepo@0.2.0 npx-smoke --apps next,vite,tanstack-start,expo --auth none --no-install --no-git` generated all four apps successfully.
+
+An initial npx invocation from inside this package's own checkout failed to find the executable. The same registry command succeeded from the temporary directory. These post-publication smoke checks skipped generated dependency installation; the release workflow had already tested the generated builds. The bootstrap token authenticated the first publish. Token-free OIDC publishing still needs npm trusted-publisher configuration and verification.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-convex-monorepo",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Generate typed Convex monorepos with composable frontend and authentication adapters.",
   "license": "MIT",
   "type": "module",