dsh-keys-manager 0.0.0-stage → 0.0.0

package/README.md

@@ -1,3 +1,16 @@
-# Temporary Holding Version
+# dsh-keys-manager (placeholder 0.0.0)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+This release only **reserves the npm package name** for the real project:
+https://github.com/btspoony/dsh-keys-manager
+
+- Do **not** install or depend on `0.0.0`. It is published under the
+  `placeholder` dist-tag, never `latest`.
+- `0.0.0` is permanently reserved: npm never allows republishing the same
+  version, so every real release must use a version greater than `0.0.0`.
+- Real releases are published automatically from the repository by GitHub
+  Actions OIDC trusted publishing (`.github/workflows/release.yml`): merging
+  a `release vX.Y.Z` PR runs validate → build → test → `npm publish
+  --provenance --access public`.
+- Dist-tag contract of the real workflow: formal `X.Y.Z` versions publish to
+  `latest`; prerelease versions (e.g. `0.1.1-alpha.1`) publish to their
+  prerelease prefix tag (e.g. `alpha`) and never touch `latest`.

package/index.js

@@ -0,0 +1,30 @@
+// Placeholder stub for the `dsh-keys-manager` package name.
+// The real package ships from https://github.com/btspoony/dsh-keys-manager
+// via GitHub Actions OIDC trusted publishing (.github/workflows/release.yml).
+//
+// 0.0.0 is permanently reserved as the placeholder version: npm never allows
+// republishing the same version, so every real release must use a version
+// greater than 0.0.0.
+//
+// Load-time behavior: warn only, so bundler static analysis and accidental
+// transitive installs never crash at require/import time. Call-time behavior:
+// the exported function throws, so actual usage of this stub fails loudly
+// with an actionable message instead of being silently broken.
+
+'use strict';
+
+const MESSAGE =
+  'dsh-keys-manager@0.0.0 is a placeholder package. Install a real version (> 0.0.0) from https://github.com/btspoony/dsh-keys-manager';
+
+// Warn once at load time except in production builds (set
+// DSH_KEYS_MANAGER_WARN=1 to force the warning there too).
+if (process.env.NODE_ENV !== 'production' || process.env.DSH_KEYS_MANAGER_WARN === '1') {
+  console.warn(`[dsh-keys-manager] ${MESSAGE}`);
+}
+
+module.exports = function dshKeysManagerPlaceholder() {
+  throw new Error(MESSAGE);
+};
+
+// Machine-readable marker so tooling can detect the stub without importing it.
+module.exports.isPlaceholder = true;

package/package.json

@@ -1,6 +1,27 @@
 {
   "name": "dsh-keys-manager",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.0",
+  "description": "Placeholder release that reserves the package name. The real package ships from https://github.com/btspoony/dsh-keys-manager via CI trusted publishing. Do not install 0.0.0.",
+  "license": "MIT",
+  "main": "index.js",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/btspoony/dsh-keys-manager.git"
+  },
+  "bugs": {
+    "url": "https://github.com/btspoony/dsh-keys-manager/issues"
+  },
+  "homepage": "https://github.com/btspoony/dsh-keys-manager#readme",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "keys",
+    "provider",
+    "llm",
+    "placeholder"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}