8.3.13 Publish `@motir/brand@0.1.0` to npm by hand + configure its Trusted Publisher (manual)

Type: manual · Executor: human · Repo: motir-core (the package and its release lane live there; this card opens no pull request).

⚠️ A CODING AGENT CANNOT DO THIS. It needs npm credentials for the @motir scope, an OTP, and the npmjs.com settings UI. That is why it is a manual card and not a step inside MOTIR-1152.

The gap

packages/brand/ is on motir-core's origin/main at version 0.1.0, shipped by MOTIR-1456 (motir-core#2387, merged). The package was never published. Measured 2026-08-28:

npm view @motir/brand           -> E404 Not Found
npm pack @motir/brand@0.1.0     -> E404 Not Found
npm view @motir/design-system   -> 0.1.0        (control: same registry, resolves)
npm view @motir/cli             -> 0.3.0        (control: same registry, resolves)
git ls-remote --tags origin | grep -E 'brand|design-system'
                                -> refs/tags/design-system-v0.1.0   (no brand-v* tag)

Why every in-repo signal was green anyway. motir-core consumes it as "@motir/brand": "workspace:*" with pnpm --filter @motir/brand build in postinstall, so its build, typecheck, tests and the thirteen BrandMark import sites all resolve through the workspace link and never touch the registry. The registry is only reached by a SEPARATE repository — which is the one consumer that does not exist yet.

Why the release lane cannot do it. .github/workflows/release-brand.yml fires on a brand-v* tag and authenticates by OIDC Trusted Publishing. Its own header states the constraint: "THE FIRST PUBLISH (0.1.0) MUST BE CUT BY HAND. OIDC Trusted Publishing cannot bootstrap a package that does not exist yet — the Trusted Publisher config lives on the package's own settings page on npmjs.com, which there is nothing to attach to until a first version is there… a tag push reaches the publish step and fails on auth." @motir/design-system@0.1.0 was bootstrapped the same way.

What to do

1. From a clean checkout of motir-core origin/main: pnpm install && pnpm --filter @motir/brand build.
2. cd packages/brand && npm publish --access public (an OTP will be requested).
3. On npmjs.com → the @motir/brand package → Settings → configure the Trusted Publisher: org moooon-B-V, repository motir-core, workflow release-brand.yml. Every release from 0.1.1 onward then flows through git tag brand-v<x.y.z> && git push origin <tag> with no stored NPM_TOKEN.
4. Pull it back as an ANONYMOUS consumer would and record the digest (below).

Acceptance criteria

• @motir/brand@0.1.0 is on the public npm registry and its Trusted Publisher is configured for moooon-B-V/motir-core → release-brand.yml.
• The artifact is PULLED, not cited: npm pack @motir/brand@0.1.0 run with no npm credential succeeds, and the tarball contains brand.css, dist/, NOTICE and README.md. Quote the resulting dist.shasum / integrity digest ON THIS CARD — the digest is the deliverable, a version number on the package page is not (run.md's artifact-obtainable check; the publisher's own view of the page says nothing about the consumer's).
• The .brand-* presentation and WAVE_BAND_PATH in the published tarball are byte-identical to packages/brand/ at the origin/main commit published from — a hand publish must not ship a dirty tree.
• ORDERING — this card closes BEFORE MOTIR-1152 opens a worktree, and it reads on the REGISTRY rather than on any branch. Nothing here depends on an unmerged pull request: packages/brand@0.1.0 is already on origin/main, so this card is startable today and its evidence is a registry read, not a merge. It does not close on motir-core CI going green — CI never publishes this package.
• No version bump. 0.1.0 is what packages/brand/package.json already declares on origin/main, and the release lane's tag guard asserts tag == version; publishing anything else strands that guard.

Context refs

• motir-core/packages/brand/package.json (version 0.1.0, publishConfig.access: public, files: [dist, brand.css, NOTICE]) · packages/brand/README.md → Releasing
• motir-core/.github/workflows/release-brand.yml — the lane, and the bootstrap constraint in its header
• MOTIR-3724 — the ADR that chose "a second published package" as the mechanism, so a copied .brand-* block in another repository is NOT an acceptable substitute
• MOTIR-1456 (done) — shipped the source; its own comment thread records this step as outstanding
• blocks MOTIR-1152 — the motir.co landing composes the brand lockup in its top bar and footer (30 references across every panel of design/marketing/landing.mock.html)