ci(publish): target public npmjs releases

## Summary
Switch package publishing from GitHub Packages to public npmjs and update
install and release docs to match.

## Changes
- retarget the publish workflow to registry.npmjs.org using NPM_TOKEN
- make package publish metadata public and remove GitHub Packages pinning
- simplify install docs for public npmjs usage
- add a changeset covering the publishable packages
- fix package export ordering so type-aware linting resolves parser types

## Why
The packages are already intended to be publicly consumable, and the GitHub
Packages-specific flow was adding auth friction and confusing agents about
where releases actually land.

## Testing
- npm whoami with the provided token against npmjs returned 401 Unauthorized
- pnpm lint
- pnpm test
- ruby -e 'require "yaml"; YAML.load_file(".github/workflows/publish-packages.yml"); puts "YAML_OK"'

Author: 4ndr3wxh1ll

.changeset/config.json

@@ -4,7 +4,7 @@
   "commit": false,
   "fixed": [],
   "linked": [],
-  "access": "restricted",
+  "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
   "ignore": ["@recallnet/codecontext-spec"]

.changeset/few-bananas-share.md

@@ -0,0 +1,8 @@
+---
+"@recallnet/codecontext-cli": patch
+"@recallnet/codecontext-parser": patch
+"@recallnet/codecontext-eslint-plugin": patch
+"@recallnet/codecontext-tsdoc": patch
+---
+
+Publish all packages publicly to npmjs and update package metadata for the new registry.

.github/workflows/publish-packages.yml

@@ -1,8 +1,8 @@
-# Publish Packages — publishes @codecontext/* packages to GitHub Packages (npm).
+# Publish Packages — publishes @recallnet/* packages to npmjs.
 #
 # Triggers after CI completes on main. Uses changesets to determine which
-# packages have version bumps pending. Versions, commits, and publishes
-# when changesets are present.
+# packages have version bumps pending. Versions, commits, and publishes to
+# npmjs when changesets are present.
 #
 # Only runs on the main repo (not forks) and only on main branch pushes.
 
@@ -28,7 +28,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      packages: write
 
     steps:
       - uses: actions/checkout@v4
@@ -45,8 +44,7 @@ jobs:
         with:
           node-version: 22
           cache: "pnpm"
-          registry-url: "https://npm.pkg.github.com"
-          scope: "@recallnet"
+          registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -88,4 +86,4 @@ jobs:
         if: steps.changesets.outputs.has_changesets == 'true'
         run: pnpm changeset publish
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.npmrc

@@ -1,3 +1 @@
 auto-install-peers=true
-@recallnet:registry=https://npm.pkg.github.com
-//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}

AGENTS.md

@@ -6,6 +6,7 @@
   merge to `main`.
 - The publish automation lives in
   `.github/workflows/publish-packages.yml`.
+- The canonical public registry is npmjs, not GitHub Packages.
 - That workflow only publishes when CI succeeds on `main` and there is at
   least one pending file in `.changeset/`.
 - If there is no pending changeset, the workflow does nothing, even if code in
@@ -26,5 +27,7 @@
   behavior. Parser releases do not ship CLI-only fixes.
 - Do not close a bug as "published" just because the fix merged. Confirm the
   package version changed on the registry.
+- For public installs, verify against npmjs with `npm view`, not GitHub
+  Packages.
 - If a package fix merged without a changeset, publishing will not happen until
   a new commit adds the missing changeset.

README.md

@@ -353,49 +353,7 @@ See the full [specification](packages/spec/SPEC.md) for adaptation rules and con
 
 ## Quick Start
 
-### 1. Authenticate for GitHub Packages
-
-The npm packages in the `@recallnet` scope are published to GitHub Packages, so
-you need a token before `pnpm` or `npm` can install them.
-
-Check whether the GitHub CLI is already authenticated:
-
-```bash
-gh auth status
-```
-
-If not, log in:
-
-```bash
-gh auth login
-```
-
-For project or CI use, prefer an environment variable backed by your GitHub CLI
-token:
-
-```bash
-export NODE_AUTH_TOKEN=$(gh auth token)
-```
-
-Then configure your project's `.npmrc`:
-
-```ini
-@recallnet:registry=https://npm.pkg.github.com
-//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}
-```
-
-For a one-off local setup, you can also write the token directly to your npm
-config:
-
-```bash
-npm config set @recallnet:registry https://npm.pkg.github.com
-npm config set //npm.pkg.github.com/:_authToken "$(gh auth token)"
-```
-
-If you manage tokens manually instead of using `gh`, the token needs
-`read:packages` access to install private packages from GitHub Packages.
-
-### 2. Install the CLI
+### 1. Install the CLI
 
 ```bash
 pnpm add -D @recallnet/codecontext-cli @recallnet/codecontext-parser
@@ -417,11 +375,10 @@ Verify the CLI is available:
 npx codecontext --help
 ```
 
-If install fails with `401 Unauthorized` or `403 Forbidden`, re-run
-`gh auth status`, refresh `NODE_AUTH_TOKEN`, and confirm your `.npmrc` points at
-`https://npm.pkg.github.com` for the `@recallnet` scope.
+The packages are published publicly on npmjs, so you do not need GitHub
+Packages auth or a custom `.npmrc` for normal installs.
 
-### 3. Run the core agent loop
+### 2. Run the core agent loop
 
 ```bash
 # Brief the agent before editing
@@ -434,7 +391,7 @@ npx codecontext --diff HEAD src/your-file.ts
 npx codecontext --staged
 ```
 
-### 4. Configure ESLint (optional)
+### 3. Configure ESLint (optional)
 
 ```javascript
 // eslint.config.js
@@ -446,7 +403,7 @@ export default [
 ];
 ```
 
-### 5. Create context directory
+### 4. Create context directory
 
 ```bash
 mkdir -p docs/context

packages/cli/package.json

@@ -9,8 +9,7 @@
     "directory": "packages/cli"
   },
   "publishConfig": {
-    "registry": "https://npm.pkg.github.com",
-    "access": "restricted"
+    "access": "public"
   },
   "type": "module",
   "bin": {

packages/eslint-plugin/package.json

@@ -9,18 +9,17 @@
     "directory": "packages/eslint-plugin"
   },
   "publishConfig": {
-    "registry": "https://npm.pkg.github.com",
-    "access": "restricted"
+    "access": "public"
   },
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
+      "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
-      "require": "./dist/index.cjs",
-      "types": "./dist/index.d.ts"
+      "require": "./dist/index.cjs"
     }
   },
   "files": [

packages/parser/package.json

@@ -2,25 +2,24 @@
   "name": "@recallnet/codecontext-parser",
   "version": "0.2.0",
   "private": false,
-  "description": "Core parser for @context tags and .ctx.md files",
+  "description": "Core parser for @context tags and supporting refs",
   "repository": {
     "type": "git",
     "url": "https://github.com/recallnet/codecontext.git",
     "directory": "packages/parser"
   },
   "publishConfig": {
-    "registry": "https://npm.pkg.github.com",
-    "access": "restricted"
+    "access": "public"
   },
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
+      "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
-      "require": "./dist/index.cjs",
-      "types": "./dist/index.d.ts"
+      "require": "./dist/index.cjs"
     }
   },
   "files": [

packages/tsdoc/package.json

@@ -9,8 +9,7 @@
     "directory": "packages/tsdoc"
   },
   "publishConfig": {
-    "registry": "https://npm.pkg.github.com",
-    "access": "restricted"
+    "access": "public"
   },
   "files": [
     "tsdoc-base.json"