fix(release): publish local npm artifact and prepare 1.0.1

.github/workflows/publish-npm.yml

@@ -140,10 +140,12 @@ jobs:
           echo "artifact_name=npm-package-${PACKAGE_VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Dry run npm publish
-        if: github.event_name == 'workflow_dispatch'
         env:
           TARBALL: ${{ steps.package.outputs.tarball }}
-        run: npm publish "$TARBALL" --access public --tag latest --dry-run --registry https://registry.npmjs.org
+        run: |
+          mkdir -p artifact
+          cp "$TARBALL" artifact/
+          npm publish "./artifact/$TARBALL" --access public --tag latest --dry-run --registry https://registry.npmjs.org
 
       - name: Upload validated package
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
@@ -259,7 +261,7 @@ jobs:
             exit 1
           fi
 
-          npm publish "${tarballs[0]}" --access public --tag latest --registry https://registry.npmjs.org
+          npm publish "./${tarballs[0]}" --access public --tag latest --registry https://registry.npmjs.org
 
       - name: Verify published package metadata
         env:

CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.1] - 2026-09-23
+
+### Fixed
+
+- Publish the validated local tarball using an explicit relative path so npm
+  does not interpret the artifact directory as a GitHub repository.
+- Exercise the nested artifact path in the publish dry run for every release.
+- Remove the separate deployment approval; CI, release-source validation and
+  registry version checks still gate publication.
+
 ## [1.0.0] - 2026-09-23
 
 ### Changed

README.md

@@ -38,7 +38,7 @@ Empty `{}` is a ready result. Webhook data matches the persisted GET snapshot.
 Install the stable package from npm:
 
 ```bash
-pnpm add @call-e/[email protected].0
+pnpm add @call-e/[email protected].1
 ```
 
 Use a local checkout for development and package smoke tests:
@@ -128,7 +128,7 @@ when retrying the same logical request.
 Run the installed CLI:
 
 ```bash
-npx @call-e/[email protected].0 calls create \
+npx @call-e/[email protected].1 calls create \
   --api-key "$CALLE_API_KEY" \
   --base-url "https://api.heycall-e.com" \
   --phone "<AUTHORIZED_E164_PHONE>" \
@@ -149,7 +149,7 @@ developer events returned by the call events API.
 Query an existing call:
 
 ```bash
-npx @call-e/[email protected].0 calls get call_123 --json
+npx @call-e/[email protected].1 calls get call_123 --json
 ```
 
 Run the webhook receiver example:
@@ -210,7 +210,7 @@ if (run.result !== null) {
 Run the same published Goal through the CLI:
 
 ```bash
-npx @call-e/[email protected].0 goals run \
+npx @call-e/[email protected].1 goals run \
   --goal-id "goal_delivery_confirmation" \
   --phone "<AUTHORIZED_E164_PHONE>" \
   --variables '{"customer_name":"Taylor","order_reference":"ORD-8472","delivery_window":"July 24, 2:00-4:00 PM"}' \

RELEASE.md

@@ -14,8 +14,9 @@ workflow. Configure the trusted publisher on npm with:
 - Environment name: `npm`
 - Allowed action: `npm publish`
 
-The GitHub `npm` environment should require maintainer approval and allow
-deployments only from `main` and `v*` release tags. The publish job uses OIDC
+The GitHub `npm` environment has no required reviewers and allows deployments
+only from `main` and `v*` release tags. Publishing a versioned GitHub Release
+starts publication automatically after validation. The publish job uses OIDC
 and does not read a long-lived npm token. `NPM_TOKEN` is retained only for the
 separate, manually invoked dist-tag management workflow.
 
@@ -55,10 +56,14 @@ release. Package publication and manual dist-tag changes share one concurrency
 lock.
 
 The build job validates and packs once, then uploads exactly one tarball and a
-SHA-256 manifest. After environment approval, the publish job downloads that
+SHA-256 manifest. After validation, the publish job downloads that
 artifact and rechecks its file set, checksum, package version, and MIT license
 before publishing it with the `latest` dist-tag.
 
+Every build dry-runs publication from the same nested artifact directory used
+by the publish job. Prefix local tarball paths with `./` (or use an absolute
+path): npm can interpret `artifact/package.tgz` as GitHub shorthand.
+
 ## Test API Goal smoke
 
 Before releasing a change to Goal behavior, run the local release candidate

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@call-e/calle",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "TypeScript server SDK for the CALL-E Developer API.",
   "license": "MIT",
   "type": "module",