designsource 0.2.0 → 0.2.1

package/README.md

@@ -94,17 +94,24 @@ pnpm --filter designsource start -- create my-app --api http://localhost:3001
 
 ## Publishing
 
-Manual, by the maintainer, from this folder. Nothing in the repo publishes.
+By the maintainer, through GitHub Actions with npm trusted publishing: no npm token exists anywhere; npm accepts the release because GitHub vouches for the repository and workflow that built it. Nothing publishes on an ordinary push or merge. (npm attaches a provenance attestation only when the source repository is public, so while this one is private the releases carry none.)
 
-1. `npm login` (npm requires 2FA to publish).
-2. `pnpm version patch|minor` — every publish needs a bump.
-3. `pnpm publish --dry-run --access public` and check the tarball is `dist/index.js`, `LICENSE`, `README.md`, `package.json`. `prepublishOnly` rebuilds `dist/` first, so a stale or missing build cannot ship.
-4. `pnpm publish --access public`.
-5. Verify from an empty folder: `npx designsource@latest --help`.
+1. Bump the version in `package.json` (`pnpm version patch|minor` here) and merge to `main`. Every publish needs a bump.
+2. Rehearse, optionally: Actions → "Release designsource" → Run workflow with dry run on. It installs, builds, tests and packs without publishing.
+3. Tag the merge commit `designsource@<version>` and push the tag:
+
+   ```sh
+   git tag designsource@0.3.0 && git push origin designsource@0.3.0
+   ```
+
+   The workflow (`.github/workflows/release-designsource.yml`) refuses a tag that does not match `package.json`, runs the tests (which build `dist/` first), publishes, then installs the published version from npm and runs `--help` against it.
+4. Check the npm page shows the new version.
+
+One-time setup, done on npmjs.com: package settings → Trusted publishing → GitHub Actions, repository `KaroMourad/design-system`, workflow `release-designsource.yml`, no environment. Publishing from a laptop still works (`npm login`, `pnpm publish --access public` from this folder; `prepublishOnly` rebuilds `dist/`), but it needs your npm login and 2FA.
 
 The README's images live in the web app at `apps/web/public/designsource/` and are served from `designsource.app`; ship image changes there before the npm publish that references them. Their sources are in `assets/` here (`cover.html`, `make-gif.mjs`).
 
-`create-ds-app` was this package's first name (0.1.x). It is deprecated on npm, pointing here: `npm deprecate create-ds-app@"*" "Moved to designsource: npx designsource create my-app"`.
+`create-ds-app` was this package's first name (0.1.x, September 2026). It was deleted from npm the day after `designsource` shipped; nothing points at it any more.
 
 ## License
 

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "designsource",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "The DS source CLI: add a design system to an existing app (integrate) or start a new Next.js project from it (create) — tokens, every component and your mockup page.",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/KaroMourad/design-system.git",
+    "url": "git+https://github.com/KaroMourad/design-system.git",
     "directory": "apps/designsource"
   },
   "homepage": "https://designsource.app",