@picasuo/publish-set-contract

@picasuo/publish-set-contract validates a Vault's Publish Set without writing Vault files, making network calls, or depending on Astro, GitHub Actions, or credentials. Its public interface is the versioned Publication Contract used by Vault Release Preflight and the Site Repository.

Install the exact release

Consumers must pin the immutable Contract Package Release rather than a range:

pnpm add @picasuo/[email protected]

Release v0.2.1

The GitHub Actions workflow publishes only a pushed v* tag when all three version sources agree: the tag, package.json, and the exported publicationContractVersion. It runs build, typecheck, and tests before publishing with npm trusted publishing (id-token: write); no long-lived npm token, Vault credential, or Site deployment credential is stored in this repository.

Before creating the immutable tag, run:

pnpm build
pnpm typecheck
pnpm test

Then commit the release and push its exact tag:

git tag v0.2.1
git push origin HEAD v0.2.1

The npm package must first be configured to trust this repository and workflow for @picasuo/publish-set-contract. Never delete, move, or re-publish an existing version; select a new version for every subsequent Contract Package Release.