Merge pull request 'fix(release): soft-fail npm publish until package write token' (#5) from fix/release-npm-publish-auth into main

.gitea/workflows/ci.yml

@@ -156,6 +156,9 @@ jobs:
             "https://git.levkin.ca/api/v1/repos/ilia/playkit/releases/${RELEASE_ID}/assets"
       - name: Publish to Gitea npm registry
         # RELEASE_TOKEN (or optional NPM_PUBLISH_TOKEN) needs write:package — docs/NPM_REGISTRY.md
+        # Soft-fail: Gitea Release + tarball already published above; package registry
+        # auth is a separate token scope and should not block the git release.
+        continue-on-error: true
         run: |
           TOKEN="${{ secrets.NPM_PUBLISH_TOKEN }}"
           if [ -z "$TOKEN" ]; then TOKEN="${{ secrets.RELEASE_TOKEN }}"; fi

ROADMAP.md

@@ -14,7 +14,7 @@ Living plan for making `@levkin/playkit` more useful across Levkin repos.
 
 - [ ] End adoption pause — migrate first extra consumer (`screening` candidate)
 - [ ] Evaluate `playwright-exporter` for scheduled synthetics (may supersede bespoke cron wrappers around `playkit smoke`)
-- [ ] Optional dedicated `NPM_PUBLISH_TOKEN` (least privilege vs reuse `RELEASE_TOKEN`)
+- [ ] **Wire `NPM_PUBLISH_TOKEN` / `write:package`** — `v0.4.0` git release OK; first npm publish hit E401 (token scope). Soft-fail in CI until fixed.
 
 ## Adoption pause
 

docs/NPM_REGISTRY.md

@@ -40,3 +40,11 @@ wire it in CI (preferred if you want least privilege).
 ```bash
 npm view @levkin/playkit versions --registry https://git.levkin.ca/api/packages/ilia/npm/
 ```
+
+## Outstanding ops
+
+First `v0.4.0` Gitea Release succeeded; `npm publish` returned **E401** because `RELEASE_TOKEN` lacks `write:package`. Create/refresh a token with package write (or add `NPM_PUBLISH_TOKEN`) and either re-run the release job or publish once by hand:
+
+```bash
+npm publish --registry https://git.levkin.ca/api/packages/ilia/npm/
+```