ci: configure npm auth for release publish

.gitea/workflows/npm-release.yml

@@ -0,0 +1,117 @@
+name: npm release
+
+on:
+  push:
+    tags:
+      - 'v*'
+      - '[0-9]*'
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  verify:
+    name: verify
+    runs-on: ubuntu-latest
+    container:
+      image: node:20-bookworm
+    timeout-minutes: 20
+
+    steps:
+      - name: Install release tools
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y git curl ca-certificates
+          curl -fsSL https://bun.sh/install | bash -s -- bun-v1.3.13
+          install -m 0755 /root/.bun/bin/bun /usr/local/bin/bun
+          node --version
+          npm --version
+          bun --version
+
+      - name: Clone tagged source
+        run: |
+          set -euo pipefail
+          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          AUTH_HEADER="$(printf '%s' '${{ gitea.actor }}:${{ secrets.GITEA_TOKEN }}' | base64 -w0)"
+          git -c http.extraHeader="Authorization: Basic $AUTH_HEADER" clone --depth 1 --branch "${{ gitea.ref_name }}" "$REPO_URL" repo
+          git -C repo rev-parse HEAD
+
+      - name: Verify release tag matches package version
+        working-directory: repo
+        shell: bash
+        run: |
+          set -euo pipefail
+          TAG_NAME="${{ gitea.ref_name }}"
+          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
+
+          if [ "$TAG_NAME" = "v$PACKAGE_VERSION" ] || [ "$TAG_NAME" = "$PACKAGE_VERSION" ]; then
+            echo "Release tag $TAG_NAME matches package version $PACKAGE_VERSION"
+            exit 0
+          fi
+
+          echo "Tag $TAG_NAME does not match package.json version $PACKAGE_VERSION" >&2
+          exit 1
+
+      - name: Run verify pipeline
+        working-directory: repo
+        run: |
+          set -euo pipefail
+          bun install --frozen-lockfile
+          bun run test
+          bun run check
+          bun run build
+
+  release:
+    name: publish to npm
+    runs-on: ubuntu-latest
+    container:
+      image: node:20-bookworm
+    timeout-minutes: 20
+    needs:
+      - verify
+
+    steps:
+      - name: Install release tools
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y git curl ca-certificates
+          curl -fsSL https://bun.sh/install | bash -s -- bun-v1.3.13
+          install -m 0755 /root/.bun/bin/bun /usr/local/bin/bun
+          node --version
+          npm --version
+          bun --version
+
+      - name: Clone tagged source
+        run: |
+          set -euo pipefail
+          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          AUTH_HEADER="$(printf '%s' '${{ gitea.actor }}:${{ secrets.GITEA_TOKEN }}' | base64 -w0)"
+          git -c http.extraHeader="Authorization: Basic $AUTH_HEADER" clone --depth 1 --branch "${{ gitea.ref_name }}" "$REPO_URL" repo
+          git -C repo rev-parse HEAD
+
+      - name: Install dependencies
+        working-directory: repo
+        run: |
+          set -euo pipefail
+          bun install --frozen-lockfile
+
+      - name: Build package
+        working-directory: repo
+        run: |
+          set -euo pipefail
+          bun run build
+
+      - name: Publish package to npm
+        working-directory: repo
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          printf '//registry.npmjs.org/:_authToken=%s\n' "$NODE_AUTH_TOKEN" > ~/.npmrc
+          npm publish

docs/plans/2026-05-11-identitydb-wiki-docs.md

@@ -0,0 +1,65 @@
+# IdentityDB Wiki Documentation Implementation Plan
+
+> **For Hermes:** Execute this plan step-by-step. Prefer concrete repository inspection over assumptions, and verify the wiki remote after each major write.
+
+**Goal:** Verify the IdentityDB wiki repository state, create or clone it as needed, and publish concrete wiki documentation covering the project's purpose, usage, and extractor choices including `NaiveExtractor`.
+
+**Architecture:** Treat the Gitea wiki as a separate Git repository. First verify whether the wiki feature is enabled and whether the `.wiki.git` remote already exists. If the remote does not exist yet, bootstrap it with a minimal `Home.md`, then clone the wiki repo into a local working directory and author Markdown pages there. Keep the documentation practical, using the package README and current source files as the canonical content source.
+
+**Tech Stack:** Gitea, tea CLI, Git, Markdown, Bun/TypeScript project docs.
+
+---
+
+## Execution plan
+
+### Task 1: Inspect wiki availability and remote state
+
+**Objective:** Confirm that the repository has wiki support enabled and determine whether the Git-backed wiki repo already exists.
+
+**Files:**
+- Inspect: `https://git.psw.kr/p-sw/IdentityDB`
+- Read: `/home/hermes-agent/IdentityDB/README.md`
+- Read: `/home/hermes-agent/IdentityDB/src/ingestion/naive-extractor.ts`
+- Read: `/home/hermes-agent/IdentityDB/src/ingestion/llm-extractor.ts`
+
+**Verification:**
+- Check Gitea repo metadata for `has_wiki=true`.
+- Check whether `https://git.psw.kr/p-sw/IdentityDB.wiki.git` is readable.
+
+### Task 2: Bootstrap the wiki repo if missing
+
+**Objective:** Create the Git-backed wiki repository if it has not been materialized yet.
+
+**Files:**
+- Create temporarily: `/home/hermes-agent/IdentityDB-wiki-bootstrap/Home.md`
+
+**Verification:**
+- Push a first commit to `https://git.psw.kr/p-sw/IdentityDB.wiki.git`.
+- Confirm the remote becomes cloneable afterward.
+
+### Task 3: Clone the wiki repo and author concrete pages
+
+**Objective:** Write practical docs explaining why IdentityDB exists, how to use it, and where `NaiveExtractor` fits.
+
+**Files:**
+- Clone to: `/home/hermes-agent/IdentityDB.wiki`
+- Create/modify: `/home/hermes-agent/IdentityDB.wiki/Home.md`
+- Create/modify: `/home/hermes-agent/IdentityDB.wiki/Getting-Started.md`
+- Create/modify: `/home/hermes-agent/IdentityDB.wiki/Extractors.md`
+- Create/modify: `/home/hermes-agent/IdentityDB.wiki/_Sidebar.md`
+
+**Verification:**
+- Review the generated Markdown files locally.
+- Ensure internal wiki links resolve by page name.
+
+### Task 4: Commit, push, and verify the published wiki state
+
+**Objective:** Publish the wiki docs and verify the remote history reflects the changes.
+
+**Files:**
+- Commit within: `/home/hermes-agent/IdentityDB.wiki`
+
+**Verification:**
+- Run `git status --short` and `git log --oneline -n 3` in the wiki repo.
+- Push to the remote wiki repo.
+- Confirm the wiki is cloneable and the latest commit is visible remotely.