chore: default to private npm publishing and unify publish scripts

renderers/angular/package.json

@@ -23,7 +23,8 @@
     "generate-examples": "node scripts/generate-examples.mjs",
     "build": "npm run generate-examples && ng build && node ../scripts/prepare-publish.mjs --source ./dist/package.json --skip-path-adjustment",
     "prepublishOnly": "node -e \"if(!process.cwd().endsWith('dist')) { console.error('Error: This package must be published from the dist/ directory. Run `npm run build` then `npm publish dist/`'); process.exit(1); }\"",
-    "publish:package": "npm run build && npm publish dist/ --access public",
+    "publish:package": "npm run build && npm publish dist/",
+    "publish:public": "npm run publish:package -- --access public",
     "demo": "npm run generate-examples && ng serve a2ui_explorer",
     "test": "npm run generate-examples && ng test --browsers=ChromeHeadless",
     "test:ci": "npm run generate-examples && ng test --watch=false --browsers=ChromeHeadless"

renderers/docs/web_publishing.md

@@ -1,11 +1,12 @@
 # Publishing Guide for A2UI Web Packages
 
-This guide is for project maintainers. It details the manual publishing process to the npm registry for all four web-related packages in this repository:
+This guide is for project maintainers. It details the manual publishing process to the npm registry for all web-related packages in this repository:
 
 1. `@a2ui/web_core`
 2. `@a2ui/lit`
 3. `@a2ui/angular`
-4. `@a2ui/markdown-it`
+4. `@a2ui/react`
+5. `@a2ui/markdown-it`
 
 ---
 
@@ -24,101 +25,67 @@ Ensure you have an NPM Access Token with rights to the `@a2ui` organization.
 
 ---
 
-## 📦 1. Publishing `@a2ui/web_core`
+## 📦 Publishing Packages
 
-This package does not have internal `file:` dependencies, so it can be published directly from its root.
+All `@a2ui` web packages follow a similar build and publish workflow. They must be published from their generated `dist/` folders to ensure correct paths and clean `package.json` files.
+
+If you attempt to run `npm publish` in their root directories, it will fail and throw an error to protect against publishing broken paths.
 
 ### Pre-flight Checks
 1. Ensure your working tree is clean and you are on the correct branch (e.g., `main`).
-2. Update the `version` in `renderers/web_core/package.json`.
-3. Verify all tests pass:
+2. Update the `version` in the package's `package.json`.
+3. If publishing a renderer (Lit, Angular, React), ensure `@a2ui/web_core` is already published (or its version string is correctly updated) since these packages will read that version number.
+4. Verify all tests pass:
    ```sh
-   cd renderers/web_core
    npm run test
    ```
 
 ### Publish to NPM
-Because this is a scoped package (`@a2ui/`), you have two options:
-
-**Option A: Publish as Private, then promote to Public (Requires Paid NPM Account)**
-1. Publish (defaults to private):
-   ```sh
-   npm publish
-   ```
-2. Verify the package looks correct on the npm website.
-3. Promote to public:
-   ```sh
-   npm access public @a2ui/web_core
-   ```
-
-**Option B: Publish directly as Public (Free or Paid NPM Account)**
-```sh
-npm publish --access public
-```
-
-*Note: NPM automatically executes the `prepack` script (`npm run build`), compiles the TypeScript, and generates the `dist/` directory right before creating the tarball.*
-
-**What exactly gets published?**
-Only the `dist/` directory, `src/` directory (for sourcemaps), `package.json`, `README.md`, and `LICENSE` are included in the published package. This is strictly controlled by the `"files"` array in `package.json`. Internal files like this publishing guide, tests, and configuration scripts are excluded.
-
-**What about the License?**
-The package is automatically published under the `Apache-2.0` open-source license, as defined in `package.json`.
-
----
 
-## 📦 2. Publishing `@a2ui/lit`, `@a2ui/angular`, and `@a2ui/markdown-it`
+Because these are scoped packages (`@a2ui/`), they default to **private** publishing.
 
-These packages depend on `@a2ui/web_core` via a local `file:../web_core` path for development. Therefore, **they must be published from their generated `dist/` folders.** We use specialized scripts to automatically rewrite their `package.json` with the correct `@a2ui/web_core` npm version before publishing.
-
-If you attempt to run `npm publish` in their root directories, it will fail and throw an error to protect against publishing broken paths.
-
-### Pre-flight Checks
-1. Ensure `@a2ui/web_core` is already published (or its version string is correctly updated) since these packages will read that version number.
-2. Update the `version` in the package you want to publish (e.g., `renderers/lit/package.json`).
-3. Ensure all tests pass.
-
-### Publish to NPM
-For each of these packages, simply run their automated publish script:
-
-**For Lit:**
+#### Option A: Publish as Private (Default)
+This is useful for testing or internal releases.
 ```sh
-cd renderers/lit
 npm run publish:package
 ```
 
-**For Angular:**
+#### Option B: Publish as Public
+Use this for official releases.
 ```sh
-cd renderers/angular
-npm run publish:package
+npm run publish:public
 ```
 
-**For Markdown-it:**
-```sh
-cd renderers/markdown/markdown-it
-npm run publish:package
-```
+*Note: `npm run publish:public` is a shortcut for `npm run publish:package -- --access public`.*
 
-### How It Works (Explanations)
+---
+
+## 🔍 How It Works (Explanations)
 
 **What happens during `npm run publish:package`?**
-Before publishing, the script runs the necessary `build` command which processes the code. For Lit and Markdown-it, `prepare-publish.mjs` runs, and for Angular, `postprocess-build.mjs` runs. These scripts:
-1. Copy `package.json`, `README.md`, and `LICENSE` to the `dist/` folder.
-2. Read the `version` from `@a2ui/web_core`.
-3. Update the `file:` dependency in the `dist/package.json` to the actual core version (e.g., `^0.8.0`).
-4. Adjust exports and paths to be relative to `dist/`.
-5. Remove any build scripts (`prepublishOnly`, `scripts`) so they don't interfere with the publish process.
+Before publishing, the script runs the necessary `build` command which processes the code. Then, a preparation script (usually `prepare-publish.mjs`) runs, which:
+1. Copies `package.json`, `README.md`, and `LICENSE` to the `dist/` folder.
+2. If it's a renderer, it reads the `version` from `@a2ui/web_core` and updates the `file:` dependency in the `dist/package.json` to the actual core version (e.g., `^0.9.0`).
+3. Adjusts exports and paths (removing the `./dist/` prefix) so they are correct when consumed from the package root.
+4. Removes any build scripts (`prepublishOnly`, `scripts`, `wireit`) so they don't interfere with the publish process.
 
 The `npm publish dist/` command then uploads only the contents of the `dist/` directory to the npm registry.
 
+**What exactly gets published?**
+Only the `dist/` directory, `src/` directory (for sourcemaps), `package.json`, `README.md`, and `LICENSE` are included in the published package. This is strictly controlled by the `"files"` array in the original `package.json`.
+
+**What about the License?**
+The package is automatically published under the `Apache-2.0` open-source license, as defined in `package.json`.
+
 ---
 
 ## 🔖 Post-Publish
 1. Tag the release (replace with actual version): 
    ```sh
-   git tag v0.8.0
+   git tag v0.9.0
    ```
 2. Push the tag: 
    ```sh
-   git push origin v0.8.0
+   git push origin v0.9.0
    ```
 3. Create a GitHub Release mapping to the new tag.

renderers/lit/package.json

@@ -48,7 +48,8 @@
   "type": "module",
   "scripts": {
     "prepublishOnly": "node -e \"if(!process.cwd().endsWith('dist')) { console.error('Error: This package must be published from the dist/ directory. Run `npm run build` then `npm publish dist/`'); process.exit(1); }\"",
-    "publish:package": "npm run build && node ../scripts/prepare-publish.mjs && npm publish dist/ --access public",
+    "publish:package": "npm run build && node ../scripts/prepare-publish.mjs && npm publish dist/",
+    "publish:public": "npm run publish:package -- --access public",
     "build": "wireit",
     "build:tsc": "wireit",
     "dev": "npm run serve --watch",

renderers/markdown/markdown-it/package.json

@@ -37,7 +37,8 @@
     "format": "prettier --ignore-path ../.gitignore --write .",
     "format:check": "prettier --ignore-path ../.gitignore --check .",
     "prepublishOnly": "node -e \"if(!process.cwd().endsWith('dist')) { console.error('Error: This package must be published from the dist/ directory. Run `npm run build` then `npm publish dist/`'); process.exit(1); }\"",
-    "publish:package": "npm run build && node prepare-publish.mjs && npm publish dist/ --access public",
+    "publish:package": "npm run build && node ../../scripts/prepare-publish.mjs && npm publish dist/",
+    "publish:public": "npm run publish:package -- --access public",
     "test": "wireit"
   },
   "dependencies": {

renderers/react/.npmrc

@@ -0,0 +1,2 @@
+@a2ui:registry=https://us-npm.pkg.dev/oss-exit-gate-prod/a2ui--npm/
+//us-npm.pkg.dev/oss-exit-gate-prod/a2ui--npm/:always-auth=true

renderers/react/package.json

@@ -74,7 +74,8 @@
   ],
   "scripts": {
     "prepublishOnly": "node -e \"if(!process.cwd().endsWith('dist')) { console.error('Error: This package must be published from the dist/ directory. Run `npm run build` then `npm publish dist/`'); process.exit(1); }\"",
-    "publish:package": "npm run build && node ../scripts/prepare-publish.mjs && npm publish dist/ --access public",
+    "publish:package": "npm run build && node ../scripts/prepare-publish.mjs && npm publish dist/",
+    "publish:public": "npm run publish:package -- --access public",
     "build": "tsup && node scripts/postbuild.mjs",
     "dev": "tsup --watch",
     "test": "vitest run",

renderers/scripts/prepare-publish.mjs

@@ -17,6 +17,8 @@
 import { readFileSync, writeFileSync, copyFileSync, existsSync, mkdirSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 
+import { fileURLToPath } from 'node:url';
+
 // This script prepares a package for publishing.
 // Arguments:
 //   --source <path>: Path to the source package.json (defaults to ./package.json)
@@ -35,9 +37,10 @@ for (let i = 0; i < args.length; i++) {
 }
 
 const packageDir = process.cwd();
+const scriptDir = fileURLToPath(new URL('.', import.meta.url));
 const resolvedSourcePkg = resolve(packageDir, sourcePkgPath);
 const resolvedDistDir = resolve(packageDir, distDir);
-const rootDir = resolve(packageDir, '../../');
+const rootDir = resolve(scriptDir, '../../');
 
 if (!existsSync(resolvedDistDir)) {
   mkdirSync(resolvedDistDir, { recursive: true });
@@ -53,6 +56,9 @@ const pkg = JSON.parse(readFileSync(resolvedSourcePkg, 'utf8'));
 if (pkg.dependencies && pkg.dependencies['@a2ui/web_core']) {
   pkg.dependencies['@a2ui/web_core'] = '^' + coreVersion;
 }
+if (pkg.peerDependencies && pkg.peerDependencies['@a2ui/web_core']) {
+  pkg.peerDependencies['@a2ui/web_core'] = '^' + coreVersion;
+}
 
 // 3. Adjust paths
 if (!skipPathAdjustment) {

renderers/web_core/.gitignore

@@ -1,6 +1,5 @@
 node_modules/
 dist/
 .wireit/
-.npmrc
 src/v0_8/schemas/
 src/v0_9/schemas/

renderers/web_core/.npmrc

@@ -0,0 +1,2 @@
+@a2ui:registry=https://us-npm.pkg.dev/oss-exit-gate-prod/a2ui--npm/
+//us-npm.pkg.dev/oss-exit-gate-prod/a2ui--npm/:always-auth=true

renderers/web_core/package.json

@@ -59,7 +59,8 @@
   ],
   "scripts": {
     "prepublishOnly": "node -e \"if(!process.cwd().endsWith('dist')) { console.error('Error: This package must be published from the dist/ directory. Run `npm run build` then `npm publish dist/`'); process.exit(1); }\"",
-    "publish:package": "npm run build && node ../scripts/prepare-publish.mjs && npm publish dist/ --access public",
+    "publish:package": "npm run build && node ../scripts/prepare-publish.mjs && npm publish dist/",
+    "publish:public": "npm run publish:package -- --access public",
     "prepack": "npm run build",
     "build": "wireit",
     "build:tsc": "wireit",