paperclip-plugin-plica 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -5,6 +5,37 @@ Short-form. The reader-facing write-up for each version is in
 
 ## Unreleased
 
+- **A failed publish says which credential to go and fix.** npm's two rejections
+  here are both misleading: `ENEEDAUTH` in a workflow run means the package has
+  no trusted publisher, not that the runner needs `npm adduser`, and a `403`
+  from a working token means the token is read-only, not that the account is
+  wrong. `scripts/publish-npm.mjs` already knows which credential it used, so it
+  now prints the matching explanation. Both are written up in
+  [docs/releases/README.md](docs/releases/README.md#what-npms-two-credential-errors-actually-mean).
+- **A refused trusted publish reports the registry's reason, not `ENEEDAUTH`.**
+  npm asks GitHub for an OIDC token, trades it with the registry for a publish
+  credential, and on refusal discards what the registry said — leaving one error
+  that means both "no trusted publisher" and "an entry that does not match this
+  run", with a tag push as the only way to tell them apart. The new
+  `scripts/diagnose-npm-oidc.mjs` repeats those two requests and prints the
+  status and message behind them; a failed publish runs it automatically. It is
+  read-only, publishes nothing, and logs no credential.
+
+## 0.6.0
+
+- **Releases publish themselves.** Pushing a `v*` tag runs the new
+  [`release` workflow](.github/workflows/release.yml), which publishes
+  `paperclip-plugin-plica` to npm. It shares one script with a publish by hand
+  (`pnpm release:publish`), so both refuse the same things: a tag that disagrees
+  with `package.json`, a manifest left on the previous version, a version with
+  no changelog entry or release page, and an unclean checkout. `pnpm
+  check:release` runs those version checks alone, before there is a tag to
+  push. Credentials come from an npm token on the environment — the `NPM_TOKEN`
+  Actions secret in CI, the token Paperclip binds to an agent otherwise — or,
+  preferably, npm trusted publishing with no token at all; the script prints
+  which one it used. See
+  [docs/releases/README.md](docs/releases/README.md#publishing-credentials).
+
 ## 0.5.0
 
 - **Published to npm as `paperclip-plugin-plica`.** Install it from Paperclip's

package/dist/manifest.js

@@ -5,7 +5,7 @@ var PLUGIN_ID = "nickallevato.plugin-plica";
 var manifest = {
   id: PLUGIN_ID,
   apiVersion: 1,
-  version: "0.5.0",
+  version: "0.6.0",
   displayName: "Plica",
   description: "Cross-company HUD: company panes, triage, approvals, attention, and briefing.",
   // The manifest schema has no homepage/repository fields — `author` is a plain

package/dist/ui/index.js

@@ -17825,7 +17825,7 @@ function mi({ className: e, ...t }) {
 var ik = {
   id: Wt,
   apiVersion: 1,
-  version: "0.5.0",
+  version: "0.6.0",
   displayName: "Plica",
   description: "Cross-company HUD: company panes, triage, approvals, attention, and briefing.",
   // The manifest schema has no homepage/repository fields — `author` is a plain