Ensure consuming projects have private: true in package.json

Add project.private = true to setupScripts() so that every time
npx mgr setup runs, the consuming project's package.json is marked
as private. This prevents accidental npm publishes of consuming
projects which are websites, not packages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ianwieds

CHANGELOG.md

@@ -15,6 +15,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Security` in case of vulnerabilities.
 
 ---
+## [1.0.3] - 2026-03-16
+### Added
+- Ensure consuming projects have `"private": true` in package.json during setup to prevent accidental npm publishes
+
 ## [1.0.1] - 2026-03-15
 ### Changed
 - Upgrade `node-powertools` from ^2.3.2 to ^3.0.0

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultimate-jekyll-manager",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Ultimate Jekyll dependency manager",
   "main": "dist/index.js",
   "exports": {

src/commands/setup.js

@@ -251,6 +251,7 @@ async function ensurePeerDependencies() {
 
 function setupScripts() {
   project.scripts = project.scripts || {};
+  project.private = true;
 
   Object.keys(package.projectScripts).forEach((key) => {
     project.scripts[key] = package.projectScripts[key];