From 52e55f3a7b9bf0861403e8365749803d9061875f Mon Sep 17 00:00:00 2001
From: Liz Ainslie <lizzy@lizainslie.dev>
Date: Mon, 14 Sep 2026 11:44:17 +0000
Subject: [PATCH 1/4] docs: GH Packages npm + JSR dual-publish

---
 docs/CI_DUAL_PUBLISH.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 docs/CI_DUAL_PUBLISH.md

diff --git a/docs/CI_DUAL_PUBLISH.md b/docs/CI_DUAL_PUBLISH.md
new file mode 100644
index 0000000..7ef7a91
--- /dev/null
+++ b/docs/CI_DUAL_PUBLISH.md
@@ -0,0 +1,21 @@
+# CI dual-publish (GH Packages npm + JSR)
+
+Token used to open this PR cannot edit `.github/workflows/*` (missing `workflows` scope). Apply manually:
+
+```yaml
+permissions:
+  contents: read
+  packages: write
+  id-token: write  # JSR OIDC
+```
+
+npm → GitHub Packages:
+- `registry-url: https://npm.pkg.github.com`
+- `scope: "@kolektiv"`
+- `NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}`
+
+Keep existing Yuri Capital npm publish as dual.
+
+JSR: claim `@kolektiv` on jsr.io, link package for OIDC, then `npx jsr publish`.
+
+Epic: https://github.com/KolektivComputer/.github/issues/2

From cb5729345b47e9d43093f5fcfeac7c54c2fac3a2 Mon Sep 17 00:00:00 2001
From: Liz Ainslie <lizzy@lizainslie.dev>
Date: Mon, 14 Sep 2026 11:44:19 +0000
Subject: [PATCH 2/4] chore: stub jsr.json for @kolektiv/brand-core

---
 packages/core/jsr.json | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 packages/core/jsr.json

diff --git a/packages/core/jsr.json b/packages/core/jsr.json
new file mode 100644
index 0000000..3d3f9f5
--- /dev/null
+++ b/packages/core/jsr.json
@@ -0,0 +1,8 @@
+{
+  "name": "@kolektiv/brand-core",
+  "version": "0.1.1",
+  "exports": "./dist/index.js",
+  "publish": {
+    "include": ["dist", "jsr.json", "README.md", "LICENSE"]
+  }
+}

From 3b076a4a45c043d6b0de1045ba5694aeb2bc14fe Mon Sep 17 00:00:00 2001
From: Liz Ainslie <lizzy@lizainslie.dev>
Date: Mon, 14 Sep 2026 11:44:21 +0000
Subject: [PATCH 3/4] chore: note GH Packages npm registry for @kolektiv

---
 .npmrc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.npmrc b/.npmrc
index bd5acc8..e87c0a0 100644
--- a/.npmrc
+++ b/.npmrc
@@ -4,3 +4,4 @@ prefer-workspace-packages=true
 # Fetch all public Kolektiv packages from the aggregated group repository.
 # (Publishing goes to the per-project hosted repo, e.g. brand-npm.)
 @kolektiv:registry=https://repo.yuri.capital/repository/npm-public/
+# Dual-publish target (CI): @kolektiv:registry=https://npm.pkg.github.com

From f57dfb45b648df8c05393fb1c502b7b622434f22 Mon Sep 17 00:00:00 2001
From: Liz Ainslie <lizzy@lizainslie.dev>
Date: Wed, 16 Sep 2026 04:10:45 +0000
Subject: [PATCH 4/4] docs: align dual-publish notes with org spine

Reference gradle-conventions, lock @kolektiv scope, JSR OIDC without
org JSR_TOKEN, point at themes as reference workflow.
---
 docs/CI_DUAL_PUBLISH.md | 38 ++++++++++++++++++++++++++++----------
 1 file changed, 28 insertions(+), 10 deletions(-)

diff --git a/docs/CI_DUAL_PUBLISH.md b/docs/CI_DUAL_PUBLISH.md
index 7ef7a91..7714ea3 100644
--- a/docs/CI_DUAL_PUBLISH.md
+++ b/docs/CI_DUAL_PUBLISH.md
@@ -1,6 +1,20 @@
-# CI dual-publish (GH Packages npm + JSR)
+# Dual-publish (GH Packages npm + JSR)
 
-Token used to open this PR cannot edit `.github/workflows/*` (missing `workflows` scope). Apply manually:
+Org epic: [KolektivComputer/.github#2](https://github.com/KolektivComputer/.github/issues/2)  
+Spine (Maven siblings): [gradle-conventions#1](https://github.com/KolektivComputer/gradle-conventions/pull/1) → `computer.kolektiv.publishing`
+
+## npm
+- Packages under **`@kolektiv/...` only** (already `@kolektiv/brand-core`, etc.) — do not invent a second JS scope
+- Dual: existing Yuri Capital npm **and** `https://npm.pkg.github.com` with `@kolektiv:registry=…`
+- Auth: `NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}` with `permissions.packages: write`
+
+## JSR
+- Scope `@kolektiv` (owned); stub `packages/core/jsr.json` for `@kolektiv/brand-core`
+- Actions: OIDC only — `permissions.id-token: write` — **no org `JSR_TOKEN`**
+- Mey: link package on jsr.io for GitHub Actions trusted publishing
+- Not a substitute for npm publish
+
+## Workflow paste (token may lack `workflows` scope)
 
 ```yaml
 permissions:
@@ -9,13 +23,17 @@ permissions:
   id-token: write  # JSR OIDC
 ```
 
-npm → GitHub Packages:
-- `registry-url: https://npm.pkg.github.com`
-- `scope: "@kolektiv"`
-- `NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}`
-
-Keep existing Yuri Capital npm publish as dual.
+```yaml
+- uses: actions/setup-node@v4
+  with:
+    registry-url: https://npm.pkg.github.com
+    scope: "@kolektiv"
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+```
 
-JSR: claim `@kolektiv` on jsr.io, link package for OIDC, then `npx jsr publish`.
+```yaml
+- run: npx jsr publish
+```
 
-Epic: https://github.com/KolektivComputer/.github/issues/2
+Reference implementation: KolektivComputer/themes `publish.yml` + `.github/scripts/publish-*.sh`.