ci: publish packages via git release branches, drop registry dependency

README.md

@@ -1,53 +1,63 @@
 # vitanovaPackages
 
-Shared client packages consumed by `marketplaces` and other projects as npm dependencies.
+Shared client packages consumed by `marketplaces` and other projects.
 
-- `packages/auth` — `@marketplaces/auth`. Real implementation. Two independent mechanisms: `telegram/` (live QR/session auth for customer + admin) and `ed25519/` (challenge/response admin auth, backend not shipped yet).
+- `packages/auth` — `@marketplaces/auth`. Real implementation. Two independent mechanisms: `telegram/` (live QR/session auth, customer + admin) and `ed25519/` (challenge/response admin auth, backend not shipped yet).
 - `packages/payment` — `@marketplaces/payment`. Scaffold only, no implementation yet.
 
-Full consumer documentation lives in the `marketplaces` repo: `docs/PACKAGES-USAGE.md`. Rationale: `docs/context/adrs/ADR-0001-extract-auth-and-payment-into-shared-marketplaces-packages.md`.
+Consumer documentation lives in the `marketplaces` repo: `docs/PACKAGES-USAGE.md`. Rationale: `docs/context/adrs/ADR-0001-extract-auth-and-payment-into-shared-marketplaces-packages.md`.
+
+## Installing (no registry, no token)
+
+Each package is published to a **release branch** where the repo root *is* the package, so npm can install it straight over git:
+
+```json
+{
+  "dependencies": {
+    "@marketplaces/auth": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/auth",
+    "@marketplaces/payment": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/payment"
+  }
+}
+```
+
+No npm registry, no auth token, no SSH tunnel, no CI secret. Anonymous git read is all that's required — a fresh clone plus `npm install` works on any machine and any CI runner.
+
+`release/auth` and `release/payment` are **generated**. Never commit to them by hand; they are force-pushed on every release.
 
 ## Layout
 
-npm workspaces monorepo. Each package builds standalone with `tsc` to `dist/`, which is the only thing published (`files: ["dist"]`).
+npm workspaces monorepo. Each package builds standalone with `tsc` to `dist/`.
 
 ```bash
 npm ci
-npm run build     # builds all workspaces
-npm test          # runs all workspace tests
+npm run build     # all workspaces
+npm test          # all workspaces
 ```
 
-Angular and rxjs are `peerDependencies` — the consuming app supplies them, so there is exactly one copy of Angular at runtime.
+Angular and rxjs are `peerDependencies`, so the consuming app supplies exactly one copy at runtime.
 
 ## Making a change
 
 1. Edit under `packages/<name>/src`, export from `index.ts`.
 2. `npx changeset` — pick the package and bump type, write one line. CI rejects PRs without one.
-3. Open a PR. `ci.yml` builds, tests, and checks for the changeset.
-4. On merge to `main`, `release.yml` opens a "Version Packages" PR. Merging *that* publishes.
+3. Open a PR against `main`. `ci.yml` builds, tests, and verifies the changeset exists.
+4. On merge, `release.yml` rebuilds and force-pushes the release branches, and opens a "Version Packages" PR if there are unreleased changesets. Merging that PR bumps versions and triggers another release.
+5. In the consuming project, run `npm update @marketplaces/auth` (git deps track the branch tip, so pin to a tag or commit SHA instead of the branch if you need reproducible installs).
 
-## Registry — read this before expecting CI to publish
+### Pinning
 
-Packages go to a **private Verdaccio registry running on the dev server** (`213.21.246.138`, Docker container `verdaccio`, storage `/srv/marketplaces/verdaccio/`), not npmjs.
+Branch refs move. For reproducible builds, pin to a commit:
 
-It currently listens on `127.0.0.1:4873` and the server firewall allows only 80/443/SSH — **so no CI runner can reach it.** `release.yml` fails loudly at the auth step rather than pretending to succeed. Resolving this needs one of:
-
-- a reverse proxy through the existing nginx (a server-config change, plus TLS — there is no certificate on that box yet), or
-- opening the port (plain HTTP with credentials on it — not recommended), or
-- moving to a hosted registry entirely.
-
-Until then, publish manually through an SSH tunnel:
-
-```bash
-ssh -L 4873:127.0.0.1:4873 seto@213.21.246.138
+```
+git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#<commit-sha>
 ```
 
-```bash
-npm login --registry=http://127.0.0.1:4873/ --scope=@marketplaces
-npm run build
-cd packages/auth && npm publish --registry http://127.0.0.1:4873/
-```
+`marketplaces` currently tracks `#release/auth` (branch tip) — deliberate while the package churns, worth pinning once it stabilises.
 
-Once reachable, set repo secrets `NPM_REGISTRY_URL` and `NPM_TOKEN` and CI takes over.
+## Workflow syntax
 
-`release.yml`/`ci.yml` use GitHub Actions syntax. Gitea/Forgejo Actions are compatible; other CI systems need translating (same steps: install, build, test, changesets).
+`ci.yml` / `release.yml` are GitHub Actions. Gitea/Forgejo Actions are compatible. Other CI needs translating — the steps are just: install, build, test, force-push a branch.
+
+## A private npm registry also exists
+
+A Verdaccio instance runs on the dev server (`213.21.246.138:4873`, Docker container `verdaccio`, storage `/srv/marketplaces/verdaccio/`) and holds `@marketplaces/auth@0.1.0` and `@marketplaces/payment@0.1.0`. It is **not** the path anything uses today — it is only reachable from the server itself or through an SSH tunnel, which is exactly why the git-branch approach above exists. Keep it or delete it; nothing depends on it.