🐸 Versioned release

CHANGELOG.md

@@ -4,6 +4,19 @@
 
 
 
+
+## 1.3.0
+<sub>2026-09-17</sub>
+
+- [#15](https://github.com/dmno-dev/fledgling/pull/15)  *(minor)*
+  **`publish: true|false` replaces `permissions`.** npm grants every trusted publisher staged publishing (`npm stage`) — a config created with `--allow-publish` alone reads back with both permissions. The only real choice is whether the publisher may also `npm publish` directly, so the config key is now a boolean (`"publish": true`, default) with `--publish` / `--no-publish` flags. The old `permissions: publish | stage | both` still works (`stage` → `false`, the rest → `true`) with a deprecation note, and `fledgling init` asks the yes/no question. `sync` no longer reports every package as out of sync over the implied `createStagedPackage`.
+
+  **Failed trust reads are no longer reported as "not configured".** `sync` and the wizard read each package's trust config with a captured `npm trust list --json`, which can't run npm's browser 2FA itself. When that read failed (no remembered 2FA approval), it was silently treated as an empty config — so `sync` claimed nothing was set up, and would happily offer to "fix" everything. Reads now distinguish a failure (`EOTP` etc.) from an empty config: `sync` probes right after npm's interactive approval (with a short retry for the registry's "remember for 5 minutes" grace to kick in) and stops with a clear message if the approval didn't stick; a read that fails mid-run is listed as "couldn't be read" and left alone; and the add/wizard flow fails that package instead of writing blind.
+- [#16](https://github.com/dmno-dev/fledgling/pull/16)  *(minor)*
+  New `include` config option: list exact package names that have no package.json in the workspace — e.g. per-platform native binary packages published as optional dependencies — and fledgling treats them like discovered packages (claimed, trusted, synced, tab-completed). They're npm-only; `fledgling jsr` skips them.
+- [#12](https://github.com/dmno-dev/fledgling/pull/12)  *(patch)*
+  Read npm's own `NPM_CONFIG_OTP` env var as a fallback for `--otp`, so a 2FA code supplied that way also suppresses the interactive browser-approval prompt instead of fledgling assuming it still needs one. Docs now lead with npm's browser flow — approving with a passkey or security key is how most people will do this, and npm is moving away from authenticator codes — with the `--otp` / `--otp-secret` options kept but framed as the legacy fallback.
+
 ## 1.2.1
 <sub>2026-07-30</sub>
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "fledgling",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "🐣 Hatch your new npm package safely - claim the name on npm and set up / sync trusted publishing settings, for one package or a whole monorepo.",
   "keywords": [
     "npm",