Prepare the packages for their first npm release as 0.2.0

PACKAGES.md

@@ -1,10 +1,10 @@
 # Consuming pgstencil
 
-Three packages share version 0.1.0: `pgstencil` (infrastructure and test primitives), `@pgstencil/auth` (email/OAuth/session services and a JSON HTTP adapter), and `@pgstencil/stripe` (SaaS billing and StripeDev). They are private workspace packages for now; no registry account is needed to consume their tarballs.
+Three packages share version 0.2.0: `pgstencil` (infrastructure and test primitives), `@pgstencil/auth` (email/OAuth/session services and a JSON HTTP adapter), and `@pgstencil/stripe` (SaaS billing and StripeDev). They are published to npm as 0.x releases, so a minor release may break compatibility.
 
 Run `pnpm packages:pack` to produce the three archives in `dist/packages`. They contain ESM JavaScript, TypeScript declarations, the MIT license, and required SQL/Compose assets. Workspace development uses source exports; packing switches the exports to compiled files. Nothing runs migrations during install.
 
-Copy the tarballs to a consumer's `vendor/` directory, depend on them using `file:` paths, and override all three package names to those same paths in the consumer's pnpm configuration. The override for `pgstencil` ensures auth and billing's peer also resolves locally. `packages:pack` refuses a modified build input tree, because an untracked file under `migrations` would otherwise ship in the archive; `--allow-dirty` overrides that for a local experiment. Commit the archives and lockfile together for a reproducible temporary distribution. Once public npm is configured, replace these paths with exact registry versions and remove the overrides.
+Copy the tarballs to a consumer's `vendor/` directory, depend on them using `file:` paths, and override all three package names to those same paths in the consumer's pnpm configuration. The override for `pgstencil` ensures auth and billing's peer also resolves locally. `packages:pack` refuses a modified build input tree, because an untracked file under `migrations` would otherwise ship in the archive; `--allow-dirty` overrides that for a local experiment. Commit the archives and lockfile together for a reproducible temporary distribution. An application that installs a released version from npm uses an ordinary version range instead, with no overrides.
 
 Every archive carries `package/dist/provenance.json`, holding the 40-character `commit` it was packed from plus `"dirty": true` when `--allow-dirty` packed a modified tree. Read it without unpacking the archive: `tar -xOf vendor/pgstencil-0.1.0.tgz package/dist/provenance.json`. That path is the contract; nothing else in the archive identifies its source, since npm's `gitHead` is absent from a `pnpm pack` of a private package. A consumer should record the commit it vendored, re-derive it from the archive on every build, and refuse an archive whose commit differs or that is marked dirty. `pnpm packages:verify` makes the same assertion against this checkout's `HEAD`, so a stale archive fails CI here. Having recovered the commit, a consumer confirms it was audited by reading its check run — `gh api repos/diffplug/pgstencil/commits/<sha>/check-runs` lists `security-audit`, which succeeds only when that commit's audit against [SECURITY.md](SECURITY.md) reached `VERDICT: PASS`.
 

README.md

@@ -32,7 +32,7 @@ Use `PORT=3000 pnpm dev` for a fixed port. Development uses real time so cooldow
 | Email              | Injected `EmailSender`, with `EmailDev` capture, waiting, unread checks and preview routes            |
 | Snapshots          | Vitest file snapshots plus local JSON, response, HTML, Markdown and email captures                    |
 
-The workspace contains `pgstencil`, `@pgstencil/auth`, and `@pgstencil/stripe`. They are not yet published to npm; [PACKAGES.md](PACKAGES.md) explains consumption through compiled local tarballs. The core package's `pgstencil/postgres` export is the runtime connection layer; `pgstencil/database` and `pgstencil/testing` include local Docker infrastructure. `examples/login` is a complete consumer, using Node's HTTP server and native HTML forms. No frontend framework is required.
+The workspace contains `pgstencil`, `@pgstencil/auth`, and `@pgstencil/stripe`. They are published to npm as 0.x releases; [PACKAGES.md](PACKAGES.md) explains installing them and consuming unreleased changes through compiled local tarballs. The core package's `pgstencil/postgres` export is the runtime connection layer; `pgstencil/database` and `pgstencil/testing` include local Docker infrastructure. `examples/login` is a complete consumer, using Node's HTTP server and native HTML forms. No frontend framework is required.
 
 Hono and Cloudflare Workers are supported through the shared Fetch adapter and request-scoped Hyperdrive connections. See [WORKERS.md](WORKERS.md) for the deployable example, local runtime tests, and deployment preparation.
 

packages/auth/README.md

@@ -0,0 +1,11 @@
+# @pgstencil/auth
+
+Email, Google, Apple, Microsoft, Facebook and GitHub authentication for Node, Hono and Cloudflare Workers.
+
+> **Built for our own applications.** pgstencil is developed alongside DiffPlug's products and published so they can share it. It is 0.x: a minor release may break compatibility, and there is no support promise.
+
+```sh
+pnpm add @pgstencil/auth pgstencil kysely hono
+```
+
+The packages after the first are peer dependencies: your application owns their versions and shares one copy with pgstencil. See [PACKAGES.md](https://github.com/diffplug/pgstencil/blob/main/PACKAGES.md) for usage and the dependency policy, and [SECURITY.md](https://github.com/diffplug/pgstencil/blob/main/SECURITY.md) for the audited security rules. Source: [diffplug/pgstencil](https://github.com/diffplug/pgstencil).

packages/auth/package.json

@@ -1,7 +1,6 @@
 {
   "name": "@pgstencil/auth",
-  "version": "0.1.0",
-  "private": true,
+  "version": "0.2.0",
   "type": "module",
   "exports": {
     ".": "./src/index.ts",
@@ -48,6 +47,7 @@
     "better-auth-migrations"
   ],
   "publishConfig": {
+    "access": "public",
     "exports": {
       ".": {
         "types": "./dist/index.d.ts",
@@ -123,7 +123,7 @@
       }
     }
   },
-  "description": "Email, Google, Apple, Facebook and GitHub authentication for Node, Hono and Cloudflare Workers.",
+  "description": "Email, Google, Apple, Microsoft, Facebook and GitHub authentication for Node, Hono and Cloudflare Workers.",
   "license": "MIT",
   "homepage": "https://github.com/diffplug/pgstencil#readme",
   "repository": {

packages/pgstencil/README.md

@@ -0,0 +1,11 @@
+# pgstencil
+
+Postgres schema migrations, isolated test databases, and deterministic snapshot testing for TypeScript.
+
+> **Built for our own applications.** pgstencil is developed alongside DiffPlug's products and published so they can share it. It is 0.x: a minor release may break compatibility, and there is no support promise.
+
+```sh
+pnpm add pgstencil kysely
+```
+
+`kysely` is a peer dependency: your application owns its version and shares one copy with pgstencil. See [PACKAGES.md](https://github.com/diffplug/pgstencil/blob/main/PACKAGES.md) for usage and the dependency policy, and [SECURITY.md](https://github.com/diffplug/pgstencil/blob/main/SECURITY.md) for the audited security rules. Source: [diffplug/pgstencil](https://github.com/diffplug/pgstencil).

packages/pgstencil/package.json

@@ -1,7 +1,6 @@
 {
   "name": "pgstencil",
-  "version": "0.1.0",
-  "private": true,
+  "version": "0.2.0",
   "type": "module",
   "exports": {
     ".": "./src/index.ts",
@@ -33,6 +32,7 @@
     "LICENSE"
   ],
   "publishConfig": {
+    "access": "public",
     "exports": {
       ".": {
         "types": "./dist/index.d.ts",

packages/stripe/README.md

@@ -0,0 +1,11 @@
+# @pgstencil/stripe
+
+Stripe SaaS subscriptions, card-required trials, durable webhooks, and a local payment simulator for pgstencil.
+
+> **Built for our own applications.** pgstencil is developed alongside DiffPlug's products and published so they can share it. It is 0.x: a minor release may break compatibility, and there is no support promise.
+
+```sh
+pnpm add @pgstencil/stripe pgstencil kysely stripe
+```
+
+The packages after the first are peer dependencies: your application owns their versions and shares one copy with pgstencil. See [PACKAGES.md](https://github.com/diffplug/pgstencil/blob/main/PACKAGES.md) for usage and the dependency policy, and [SECURITY.md](https://github.com/diffplug/pgstencil/blob/main/SECURITY.md) for the audited security rules. Source: [diffplug/pgstencil](https://github.com/diffplug/pgstencil).

packages/stripe/package.json

@@ -1,7 +1,6 @@
 {
   "name": "@pgstencil/stripe",
-  "version": "0.1.0",
-  "private": true,
+  "version": "0.2.0",
   "type": "module",
   "exports": {
     ".": "./src/index.ts",
@@ -27,6 +26,7 @@
     "LICENSE"
   ],
   "publishConfig": {
+    "access": "public",
     "exports": {
       ".": {
         "types": "./dist/index.d.ts",