@clossys/butler 0.1.3 → 0.1.5

package/CHANGELOG.md

@@ -3,6 +3,33 @@
 All notable changes to this package are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.1.5] - 2026-09-17
+
+### Fixed
+
+- Removed a doc-comment citation in `src/schema.ts` that pointed at a
+  repository-root agent-policy file. `src/` is packed content and compiles
+  into `dist/`, so that comment reached an installed consumer while the file
+  it named did not: `files` carries `dist`, `src`, this changelog, the README
+  and the licence, and nothing from the repository root. The sentence now
+  states the hand-rolled-validation convention on its own, which is the part
+  a reader of the installed package can actually act on. No type, export,
+  signature, or runtime behaviour changed.
+
+## [0.1.4] - 2026-09-16
+
+### Fixed
+
+- The Install section told a consumer this package requires a GitHub
+  personal access token with `read:packages`, pointing at the repository
+  root README for confirmation. That pointer led to a section describing
+  an unrelated, still-token-gated set of packages — corroborating evidence
+  for a claim that has never been true of `@clossys/butler`, which
+  publishes to `https://registry.npmjs.org` with public access and
+  installs anonymously. A reader following the instruction as written
+  would create a credential this package never asks for. (#924)
+
+
 ## [0.1.3] - 2026-09-02
 
 ### Fixed

package/README.md

@@ -44,8 +44,9 @@ Two rules follow, and both are structural here rather than advisory:
 npm install @clossys/butler
 ```
 
-Installing from this registry needs a GitHub personal access token with
-`read:packages` — see the repository root README.
+The package publishes to the public npm registry
+(`https://registry.npmjs.org`) with public access; installing it needs no
+GitHub token or other credential.
 
 ```ts
 import { checkCurrency, evaluateStandingInstruction } from "@clossys/butler";

package/dist/schema.d.ts

@@ -41,11 +41,11 @@
  * carries nothing else.
  *
  * Validation here is hand-rolled over `unknown`, with no schema library,
- * matching every other package in this workspace (see the root
- * `AGENTS.md`). These validators exist for the boundary where records
- * arrive as untyped JSON — a preference-centre route body, a file the CLI
- * reads, a value read back out of a host's own store — before anything
- * downstream is allowed to trust them.
+ * matching every other package in this workspace. These validators exist
+ * for the boundary where records arrive as untyped JSON — a
+ * preference-centre route body, a file the CLI reads, a value read back out
+ * of a host's own store — before anything downstream is allowed to trust
+ * them.
  */
 import { type ValidationResult } from "./validation.js";
 /**

package/dist/schema.js

@@ -41,11 +41,11 @@
  * carries nothing else.
  *
  * Validation here is hand-rolled over `unknown`, with no schema library,
- * matching every other package in this workspace (see the root
- * `AGENTS.md`). These validators exist for the boundary where records
- * arrive as untyped JSON — a preference-centre route body, a file the CLI
- * reads, a value read back out of a host's own store — before anything
- * downstream is allowed to trust them.
+ * matching every other package in this workspace. These validators exist
+ * for the boundary where records arrive as untyped JSON — a
+ * preference-centre route body, a file the CLI reads, a value read back out
+ * of a host's own store — before anything downstream is allowed to trust
+ * them.
  */
 import { isOneOf, isPlainObject, pushIssue, optionalTimestamp, requireArrayOf, requireBoolean, requireNumber, requireString, requireTimestamp, } from "./validation.js";
 /** Every provenance value, for a caller validating untyped input. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clossys/butler",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "private": false,
   "license": "MIT",
   "type": "module",
@@ -77,14 +77,14 @@
   },
   "devDependencies": {
     "@testing-library/react": "^16.3.3",
-    "@types/node": "^22.10.0",
-    "@types/react": "^19.2.0",
-    "@types/react-dom": "^19.2.5",
+    "@types/node": "^26.5.1",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     "jsdom": "^26.1.0",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
     "typescript": "~6.0.0",
-    "vitest": "^4.1.9"
+    "vitest": "^5.0.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/schema.ts

@@ -41,11 +41,11 @@
  * carries nothing else.
  *
  * Validation here is hand-rolled over `unknown`, with no schema library,
- * matching every other package in this workspace (see the root
- * `AGENTS.md`). These validators exist for the boundary where records
- * arrive as untyped JSON — a preference-centre route body, a file the CLI
- * reads, a value read back out of a host's own store — before anything
- * downstream is allowed to trust them.
+ * matching every other package in this workspace. These validators exist
+ * for the boundary where records arrive as untyped JSON — a
+ * preference-centre route body, a file the CLI reads, a value read back out
+ * of a host's own store — before anything downstream is allowed to trust
+ * them.
  */
 
 import {