Skip to content

Commit 949c0df

Browse files
authored
Merge pull request #958 from makenotion/worktree/lucky-harbor-6b64
release: publish v1.0.0 to npm
2 parents 2391e75 + 4525b60 commit 949c0df

12 files changed

Lines changed: 62 additions & 141 deletions

File tree

.github/workflows/publish.yml

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Publish to GitHub Packages
1+
name: Publish to npm
22

33
on:
44
release:
@@ -14,8 +14,7 @@ jobs:
1414
runs-on: ubuntu-latest
1515
permissions:
1616
contents: read
17-
packages: write
18-
17+
id-token: write
1918
steps:
2019
- name: Checkout
2120
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -27,8 +26,7 @@ jobs:
2726
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
2827
with:
2928
node-version: 20
30-
registry-url: https://npm.pkg.github.com
31-
scope: "@makenotion"
29+
registry-url: https://registry.npmjs.org
3230

3331
- name: Install dependencies
3432
run: npm ci
@@ -46,6 +44,6 @@ jobs:
4644
run: npm run build
4745

4846
- name: Publish
49-
run: npm publish
47+
run: npm publish --provenance
5048
env:
51-
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
49+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

CHANGELOG.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,12 @@ log is the canonical source for those.
1111

1212
## [Unreleased]
1313

14+
## [1.0.0] - 2026-08-04
15+
16+
### Changed
17+
18+
- Lore is now available publicly on npm as `@makenotion/lore`.
19+
1420
## [0.19.1] - 2026-06-19
1521

1622
### Fixed
@@ -1225,7 +1231,8 @@ move atomically per the release-coordinator pattern (#13).
12251231
`lore migrate --migrate-tracking-to-tasks` still works; on 0.6.0
12261232
the prose updates to reflect the migration command's removal.
12271233

1228-
[Unreleased]: https://github.com/makenotion/lore/compare/v0.19.1...HEAD
1234+
[Unreleased]: https://github.com/makenotion/lore/compare/v1.0.0...HEAD
1235+
[1.0.0]: https://github.com/makenotion/lore/compare/v0.19.1...v1.0.0
12291236
[0.19.1]: https://github.com/makenotion/lore/compare/v0.19.0...v0.19.1
12301237
[0.19.0]: https://github.com/makenotion/lore/compare/v0.18.1...v0.19.0
12311238
[0.18.1]: https://github.com/makenotion/lore/compare/v0.18.0...v0.18.1

README.md

Lines changed: 17 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -20,51 +20,32 @@ context loading and session saving into supported hosts.
2020

2121
### 1. Install Lore
2222

23-
> **Public npm publish is intentionally parked.** Lore still publishes
24-
> internal-only releases to GitHub Packages while the team finishes the
25-
> rollout. External users should install from a local clone for now.
26-
> Internal Notion engineers can install the package from GitHub Packages
27-
> after configuring the `@makenotion` registry mapping.
28-
29-
#### Option A — local clone
23+
#### Install from npm (recommended)
3024

3125
```bash
32-
git clone https://github.com/makenotion/lore.git
33-
cd lore && npm install && npm run build && npm link
34-
```
35-
36-
`npm link` makes `lore` available globally on your `PATH` from the clone.
37-
Run `lore --version` to confirm, then continue with step 2 below.
38-
39-
#### Option B — internal GitHub Packages install
40-
41-
Configure GitHub Packages access once:
42-
43-
```bash
44-
gh auth refresh -h github.com -s read:packages
45-
export GITHUB_PACKAGES_TOKEN="$(gh auth token)"
26+
npm install -g @makenotion/lore
27+
# or
28+
npm install -D @makenotion/lore
4629
```
4730

48-
Then ensure your npm config maps the `@makenotion` scope to GitHub Packages:
49-
50-
```ini
51-
@makenotion:registry=https://npm.pkg.github.com
52-
//npm.pkg.github.com/:_authToken=${GITHUB_PACKAGES_TOKEN}
53-
```
31+
Public npm requires no registry configuration or package token.
5432

55-
Install the package:
33+
#### Build from source
5634

5735
```bash
58-
npm install -g @makenotion/lore # global CLI
59-
# or
60-
npm install -D @makenotion/lore # or yarn add -D # project-local
36+
git clone https://github.com/makenotion/lore.git
37+
cd lore && npm install && npm run build && npm link
6138
```
6239

63-
For project-local installs, run `npx lore <command>` from inside the
64-
project or add a `lore` script to `package.json`. See
65-
[`docs/dev-dependency-install.md`](docs/dev-dependency-install.md) for
66-
the Yarn PnP wiring and path-portable setup teams use to share assistant
67-
config across a repo.
40+
`npm link` makes `lore` available globally on your `PATH` from the clone.
41+
Run `lore --version` to confirm either installation route, then continue with
42+
step 2 below.
43+
44+
For project-local installs, run `npx lore <command>` from inside the project
45+
or add a `lore` script to `package.json`. See
46+
[`docs/dev-dependency-install.md`](docs/dev-dependency-install.md) for the
47+
Yarn PnP wiring and path-portable setup teams use to share assistant config
48+
across a repo.
6849

6950
### 2. Join an Existing Shared Vault
7051

docs/archive/mcp-tool-history.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,10 @@ Historical bumps and what they signalled:
6969

7070
Latest historical note:
7171

72+
- `1.0.0` (2026-08-04) publishes Lore publicly as `@makenotion/lore` on npm.
73+
The package metadata, lockfile, MCP handshake, CLI, and Notion `User-Agent`
74+
version values move together under the existing version-sync guard.
75+
7276
- `0.19.1` (2026-06-19) ships `lore doctor` support for repo-managed MCP and
7377
hook launchers. Doctor now reports committed launchers that clearly dispatch
7478
to `lore mcp` through local wrappers as `launcher: custom`, recognizes

docs/ci.md

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -88,14 +88,9 @@ not to `ci.yml`.
8888

8989
## Why `publish.yml` doesn't affect forks
9090

91-
`publish.yml` runs on `release: published`, which never fires for a fork PR,
92-
so the workflow never executes from a fork. The publish job writes to GitHub
93-
Packages with the release run's scoped `GITHUB_TOKEN`; it does not use public
94-
npm credentials. Broader publish-pipeline hardening is tracked under the
95-
package-distribution umbrella in
96-
[issue #554](https://github.com/makenotion/lore/issues/554). This doc does
97-
not claim `publish.yml` is already buttoned up — only that its trigger
98-
prevents fork PRs from invoking it.
91+
`publish.yml` only runs on `release: published`, so a fork pull request cannot
92+
run the job or access its `NPM_TOKEN`. The publish job has only `contents: read`
93+
plus `id-token: write` for npm provenance.
9994

10095
## What the local dev hooks installer does in CI
10196

docs/dev-dependency-install.md

Lines changed: 15 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -1,75 +1,23 @@
11
# Installing Lore as a Dev Dependency
22

3+
`@makenotion/lore` is publicly available from npm without registry or token
4+
setup.
5+
36
Teams that want every engineer's checkout to share the same Lore config can
47
pin `@makenotion/lore` as a devDependency and commit assistant config alongside
58
the rest of the repo. Yarn PnP is the fully path-portable shape: no absolute
6-
paths land in committed MCP config, so the same files work on every
7-
engineer's checkout.
8-
9-
Lore releases are still internal-only on GitHub Packages. The public npm
10-
cutover is parked until the team finishes one or two more internal releases,
11-
so fresh installs still need a GitHub Packages token and an `@makenotion`
12-
registry mapping.
13-
14-
## GitHub Packages Access
15-
16-
If you're already authed with the [`gh` CLI](https://cli.github.com/):
17-
18-
```bash
19-
gh auth refresh -h github.com -s read:packages
20-
21-
# zsh
22-
echo 'export GITHUB_PACKAGES_TOKEN="$(gh auth token)"' >> ~/.zshrc
23-
source ~/.zshrc
24-
25-
# bash
26-
echo 'export GITHUB_PACKAGES_TOKEN="$(gh auth token)"' >> ~/.bashrc
27-
source ~/.bashrc
28-
```
29-
30-
That's it. `gh` already manages the token; you just expose it under the name
31-
`.yarnrc.yml` / `.npmrc` reads.
32-
33-
If you don't use the `gh` CLI, or your org disables OAuth tokens for packages,
34-
create a classic Personal Access Token instead:
35-
36-
1. Visit <https://github.com/settings/tokens/new>.
37-
2. Scope: **`read:packages`**.
38-
3. `export GITHUB_PACKAGES_TOKEN=<the-token>` in your shell rc.
39-
40-
Both forms produce a token GitHub Packages accepts as a Bearer token.
9+
paths land in committed MCP config, so the same files work on every engineer's
10+
checkout.
4111

4212
## Wiring the Consumer Repo
4313

44-
1. **Configure the registry mapping.** For Yarn 4 / Berry, add to
45-
`.yarnrc.yml`:
46-
47-
```yaml
48-
npmScopes:
49-
makenotion:
50-
npmRegistryServer: "https://npm.pkg.github.com"
51-
npmAuthToken: "${GITHUB_PACKAGES_TOKEN:-}"
52-
```
53-
54-
For npm / Yarn 1, copy `.npmrc.example` and adapt it, or make sure
55-
`~/.npmrc` contains:
56-
57-
```ini
58-
@makenotion:registry=https://npm.pkg.github.com
59-
//npm.pkg.github.com/:_authToken=${GITHUB_PACKAGES_TOKEN}
60-
```
61-
62-
The `${VAR:-}` default-value form in Yarn config is load-bearing: it lets
63-
unrelated yarn invocations (`yarn run -T lore mcp`, `yarn lint`, etc.) load
64-
the file without a token. Only registry fetches need it.
65-
66-
2. **Add the devDep.**
14+
1. **Add the devDependency.**
6715

6816
```bash
6917
yarn add -D @makenotion/lore # or `npm install -D @makenotion/lore`
7018
```
7119

72-
3. **Run `lore install` once locally.** From inside the consumer repo:
20+
2. **Run `lore install` once locally.** From inside the consumer repo:
7321

7422
```bash
7523
yarn run -T lore install -y # Yarn PnP consumers
@@ -95,21 +43,22 @@ Both forms produce a token GitHub Packages accepts as a Bearer token.
9543
(PnP) or
9644
`"command": "cd \"$CLAUDE_PROJECT_DIR\" && lore hooks <event>"` (npm).
9745

98-
4. **Teach the repo's agents to prefer Lore.** Add a short "Memory and
46+
3. **Teach the repo's agents to prefer Lore.** Add a short "Memory and
9947
note-taking" section to the repo's `AGENTS.md` and `CLAUDE.md` so agents know
10048
when to call Lore tools instead of writing local-only notes. See
10149
[Quick Start step 6](../README.md#6-teach-your-agents-to-use-lore) for a
10250
pasteable starter.
10351

104-
5. **Commit the project-local diff.** Under the default `--client all` flow,
52+
4. **Commit the project-local diff.** Under the default `--client all` flow,
10553
commit the generated `.mcp.json`, `.codex/config.toml`, `.codex/hooks.json`,
10654
`.cursor/mcp.json`, and docs changes that landed in the repo.
10755

108-
**Yarn PnP consumers**: the committed files Just Work on any teammate's
109-
fresh checkout. `yarn install` resolves `@makenotion/lore` from GitHub
110-
Packages using each engineer's `GITHUB_PACKAGES_TOKEN`, and host assistants
111-
resolve `lore` through Yarn's PnPAPI. No absolute paths or `${HOME}`
112-
placeholders land in the project-local MCP config.
56+
57+
**Yarn PnP consumers**: the committed files work on any teammate's fresh
58+
checkout. `yarn install` resolves `@makenotion/lore` from npm without
59+
credentials, and host assistants resolve `lore` through Yarn's PnPAPI. No
60+
absolute paths or `${HOME}` placeholders land in the project-local MCP
61+
config.
11362

11463
**npm / Yarn 1 consumers**: the committed MCP config carries a static
11564
`LORE_CONFIG_ROOT=<checkout-path>` so hosts can launch `lore mcp` from

docs/team-rollout.md

Lines changed: 2 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -173,21 +173,8 @@ integration and distribute that shared token.
173173

174174
### Step 2 — Each engineer runs (one-time, ~2 minutes)
175175

176-
Lore releases are still internal-only on GitHub Packages. Before installing
177-
the package, expose a GitHub Packages token and make sure npm maps the
178-
`@makenotion` scope to `https://npm.pkg.github.com`:
179-
180-
```bash
181-
gh auth refresh -h github.com -s read:packages
182-
export GITHUB_PACKAGES_TOKEN="$(gh auth token)"
183-
```
184-
185-
Add this to `~/.npmrc` if it is not already present:
186-
187-
```ini
188-
@makenotion:registry=https://npm.pkg.github.com
189-
//npm.pkg.github.com/:_authToken=${GITHUB_PACKAGES_TOKEN}
190-
```
176+
Install Lore from public npm; no registry configuration or package token is
177+
required:
191178

192179
```bash
193180
# 1. Install Lore (if not already pinned as a devDependency in the team repo)

package-lock.json

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@makenotion/lore",
3-
"version": "0.19.1",
3+
"version": "1.0.0",
44
"description": "AI memory system backed by Notion",
55
"type": "module",
66
"bin": {
@@ -91,7 +91,7 @@
9191
"url": "git+https://github.com/makenotion/lore.git"
9292
},
9393
"publishConfig": {
94-
"registry": "https://npm.pkg.github.com",
95-
"access": "restricted"
94+
"registry": "https://registry.npmjs.org",
95+
"access": "public"
9696
}
9797
}

src/cli/index.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ import { costsCommand } from "./commands/costs.js"
3131

3232
const program = new Command()
3333

34-
program.name("lore").description("AI memory system backed by Notion").version("0.19.1")
34+
program.name("lore").description("AI memory system backed by Notion").version("1.0.0")
3535

3636
program.addCommand(initCommand)
3737
program.addCommand(authCommand)

0 commit comments

Comments
 (0)