License under MIT and publish with npm trusted publishing

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Av7wa3ZYPiTitvaGp2qcCU

.github/workflows/publish.yml

@@ -6,7 +6,7 @@ on:
 
 permissions:
   contents: read
-  id-token: write # npm provenance
+  id-token: write # npm trusted publishing (OIDC); provenance is attached automatically
 
 jobs:
   publish:
@@ -18,6 +18,8 @@ jobs:
           node-version: 22
           registry-url: https://registry.npmjs.org
           cache: npm
+      # Trusted publishing needs npm 11.5.1 or newer; Node 22 ships npm 10.
+      - run: npm install --global npm@latest
       - run: npm ci
       - name: Check the release tag matches package.json
         run: |
@@ -26,6 +28,4 @@ jobs:
             echo "Release tag $GITHUB_REF_NAME does not match package.json $version"
             exit 1
           fi
-      - run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - run: npm publish --access public

LICENSE.md

@@ -1 +1,21 @@
-PLACEHOLDER
+MIT License
+
+Copyright (c) 2026 Heretek-AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -101,10 +101,12 @@ npm test        # builds to dist/ and runs the tests
 
 ## Publish
 
-The package publishes from GitHub Actions when a GitHub release is published (`.github/workflows/publish.yml`).
+Releases publish from GitHub Actions with [npm trusted publishing](https://docs.npmjs.com/trusted-publishers) (OIDC), so no npm token is stored in the repository. `.github/workflows/publish.yml` runs when a GitHub release is published.
 
-1. On npmjs.com, make sure the `heretek-ai` organization exists and your account can publish to it.
-2. Create an npm **granular access token** with read and write access to `@heretek-ai` packages, and add it to this repository as the `NPM_TOKEN` Actions secret.
-3. Bump `version` in `package.json`, merge, then publish a GitHub release tagged `v<version>`.
+One-time setup:
 
-To publish by hand instead: `npm login`, then `npm publish` from a clean checkout. It runs the typecheck and tests first.
+1. The first version has to exist on npm before a trusted publisher can be attached. From a clean checkout: `npm login`, then `npm publish` (it runs the typecheck and tests first). Your npm account needs publish rights in the `heretek-ai` organization.
+2. On npmjs.com, open the package's **Settings > Trusted publishing**, choose **GitHub Actions**, and enter organization `Heretek-AI`, repository `unity.gamedev.kit`, workflow `publish.yml`.
+3. Optionally, in the same settings page, set **Publishing access** to require 2FA and disallow tokens, so only the workflow can publish.
+
+Each release after that: bump `version` in `package.json`, merge, then publish a GitHub release tagged `v<version>`.

package.json

@@ -3,7 +3,7 @@
   "version": "0.1.0",
   "description": "OpenCode plugin for Unity game development: AnkleBreaker Unity MCP, Context7, OpenSpec workflow, gamedev skill bootstrap and Unity-safe edit guards.",
   "type": "module",
-  "license": "SEE LICENSE IN LICENSE.md",
+  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Heretek-AI/unity.gamedev.kit.git"