@dcyfr/ai 3.0.2 → 3.0.4

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [3.0.4](https://github.com/dcyfr-labs/dcyfr-ai/compare/v3.0.3...v3.0.4) (2026-05-12)
+
+
+### Bug Fixes
+
+* **release:** align release-please tag format with existing v* tags ([#177](https://github.com/dcyfr-labs/dcyfr-ai/issues/177)) ([b373114](https://github.com/dcyfr-labs/dcyfr-ai/commit/b3731141900425606b7646d72cd8a93e0421f354))
+
+## 3.0.3
+
+### Patch Changes
+
+- [#173](https://github.com/dcyfr-labs/dcyfr-ai/pull/173) [`6c50c05`](https://github.com/dcyfr-labs/dcyfr-ai/commit/6c50c05f7c598f678907f43385eb653f0d2a341b) Thanks [@dcyfr](https://github.com/dcyfr)! - Remove unused `@mistralai/mistralai` dependency.
+
+  The Mistral SDK is not imported anywhere in the codebase — only a description string in `packages/ai/core/provider-registry.ts` references Mistral models served via the GitHub Models API, which doesn't require this SDK.
+
+  Clears downstream Dependabot alert [GHSA-3q49-cfcf-g5fm](https://github.com/advisories/GHSA-3q49-cfcf-g5fm) (malware in `@mistralai/mistralai` 2.2.2 / 2.2.3 / 2.2.4 with an overbroad `>= 0` blanket range that flags safe versions too) for downstream consumers like `dcyfr-labs/dcyfr-labs`.
+
 ## 3.0.1
 
 ### Patch Changes

package/README.md

@@ -1,4 +1,8 @@
-# @dcyfr/ai
+<div align="center">
+  <img src="https://raw.githubusercontent.com/dcyfr-labs/dcyfr-labs/main/public/images/dcyfr-avatar.svg" alt="DCYFR Logo" width="120" height="120" />
+  <h1>@dcyfr/ai</h1>
+  <p><em>Portable AI agent harness with plugin architecture for multi-provider integration, telemetry tracking, and quality validation.</em></p>
+</div>
 
 <!-- README-META
   tlp_clearance: GREEN
@@ -10,8 +14,6 @@
 
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/dcyfr/dcyfr-ai)
 
-> Portable AI agent harness with plugin architecture for multi-provider integration, telemetry tracking, and quality validation.
-
 [![npm](https://img.shields.io/npm/v/@dcyfr/ai?logo=npm&logoColor=white)](https://www.npmjs.com/package/@dcyfr/ai)
 [![Downloads](https://img.shields.io/npm/dm/@dcyfr/ai?logo=npm&logoColor=white)](https://www.npmjs.com/package/@dcyfr/ai)
 [![License](https://img.shields.io/badge/License-MIT-yellow?style=flat-square)](https://opensource.org/licenses/MIT)
@@ -37,7 +39,7 @@ Portable AI agent harness with plugin architecture for managing multiple AI prov
 | Plugin System  | ✅ Custom                      | ✅ Complex | ❌            | ❌      |
 | Telemetry      | ✅ Built-in                    | ❌         | ❌            | ❌      |
 | Zero Config    | ✅                             | ❌         | ✅            | ❌      |
-| Bundle Size    | Live Bundlephobia minzip badge | ~2.3MB     | ~450KB        | N/A     |
+| Bundle Size    | [![](https://img.shields.io/bundlephobia/minzip/@dcyfr/ai)](https://bundlephobia.com/package/@dcyfr/ai) | ~2.3MB     | ~450KB        | N/A     |
 | TypeScript     | ✅ Strict                      | Partial    | ✅            | ❌      |
 | Quality Gates  | ✅                             | ❌         | ❌            | ❌      |
 | Config System  | YAML/JSON/package              | Code-only  | Code-only     | JSON    |
@@ -53,7 +55,7 @@ Portable AI agent harness with plugin architecture for managing multiple AI prov
 
 - **Weekly Downloads:** Check [npm stats](https://www.npmjs.com/package/@dcyfr/ai)
 - **Dependencies:** 28 production dependencies
-- **Bundle Size:** Live Bundlephobia minzip badge (see above)
+- **Bundle Size:** See badge above ([![minzip](https://img.shields.io/bundlephobia/minzip/@dcyfr/ai)](https://bundlephobia.com/package/@dcyfr/ai))
 - **TypeScript:** Full type definitions included
 - **ESM Support:** ✅ Full ESM modules with tree shaking
 
@@ -100,10 +102,6 @@ Portable AI agent harness with plugin architecture for managing multiple AI prov
 - ⚙️ **Configuration System** - YAML/JSON config with three-layer merge
 - 📊 **Comprehensive Telemetry** - Track usage, costs, quality metrics, performance
 - ✅ **Validation Harness** - Quality gates with parallel/serial execution
-- 💾 **Pluggable Storage** - Memory, file-based, or custom adapters
-- ⚡ **Type-Safe** - Full TypeScript support with Zod validation
-- 📦 **Bundle Profile** - Live Bundlephobia minzip badge
-- 🛠️ **CLI Tools** - Config validation and initialization
 
 ## Installation
 
@@ -178,7 +176,7 @@ npx @dcyfr/ai config:validate --verbose
 
 ### Migrating from LangChain
 
-**Why migrate:** Smaller bundle footprint than LangChain (see live Bundlephobia badge), built-in telemetry, simpler API
+**Why migrate:** Smaller bundle footprint than LangChain (see [bundlephobia](https://bundlephobia.com/package/@dcyfr/ai)), built-in telemetry, simpler API
 
 ```typescript
 // LangChain (before)
@@ -206,7 +204,7 @@ const response = await runtime.chat({
 
 - Simpler configuration (YAML/JSON vs code-only)
 - Built-in telemetry tracking (no additional setup)
-- Smaller bundle size than LangChain (see live Bundlephobia badge)
+- Smaller bundle size than LangChain (see [bundlephobia](https://bundlephobia.com/package/@dcyfr/ai))
 - Type-safe validation with Zod
 - Quality gates included out of the box
 
@@ -260,7 +258,7 @@ const report = await validator.validate({
 ### Prerequisites
 
 ```bash
-# Node.js 18+ required
+# Node.js 24+ required
 node --version
 
 # Install @dcyfr/ai
@@ -754,24 +752,23 @@ See [CONTRIBUTING.md](./CONTRIBUTING.md) for contribution guidelines.
 
 ### Release Process
 
-We use [Changesets](https://github.com/changesets/changesets) for automated versioning and publishing.
+We use [release-please](https://github.com/googleapis/release-please) for automated versioning and publishing. Version bumps are derived from PR titles using [conventional commits](https://www.conventionalcommits.org/).
 
 **For contributors:**
 
-```bash
-# Add a changeset describing your changes
-npm run changeset
+Make your PR title a conventional commit (`feat:` minor, `fix:`/`deps:`/`perf:` patch, `feat!:` major). Squash-merge is required so the PR title becomes the commit on `main`.
 
-# Commit the changeset with your PR
-git add .changeset/*.md
-git commit -m "feat: your feature"
+```
+fix(memory): correct mem0 client retry semantics
+feat(provider-registry): add GitHub Models provider
+deps: bump @anthropic-ai/sdk to 0.95.2
 ```
 
 **For maintainers:**
 
-- Changesets automatically creates Release PRs
-- Merging a Release PR publishes to npm
-- See [Release Management](./docs/RELEASE_MANAGEMENT.md) for full details
+- release-please opens a Release PR aggregating unreleased commits
+- Merging the Release PR publishes to npm via OIDC Trusted Publishing
+- See [CONTRIBUTING.md](./CONTRIBUTING.md#release-process) for the full release flow
 
 [⬆️ Back to top](#dcyfr-ai)
 
@@ -931,7 +928,7 @@ Telemetry tracks: API calls, token usage, costs, latency, quality scores.
 
 **Q: Is this harness production-ready?**
 
-A: Yes! @dcyfr/ai is used in production at dcyfr-labs and other projects. It has comprehensive test coverage, semantic versioning, automated releases via Changesets, and follows best practices for package publishing.
+A: Yes! @dcyfr/ai is used in production at dcyfr-labs and other projects. It has comprehensive test coverage, semantic versioning, automated releases via release-please, and follows best practices for package publishing.
 
 [⬆️ Back to top](#dcyfr-ai)
 
@@ -944,7 +941,7 @@ A: Yes! @dcyfr/ai is used in production at dcyfr-labs and other projects. It has
 - **Config Loading:** ~10ms (cached), ~50ms (first load with file I/O)
 - **Validation Framework:** Parallel execution 2-5x faster than serial (depends on plugin count)
 - **Plugin System:** Minimal overhead ~5ms per plugin registration
-- **Bundle Size:** Live Bundlephobia minzip badge
+- **Bundle Size:** See [bundlephobia.com/@dcyfr/ai](https://bundlephobia.com/package/@dcyfr/ai) for current minzip size
 
 ### Recommended Usage Patterns
 
@@ -957,7 +954,7 @@ A: Yes! @dcyfr/ai is used in production at dcyfr-labs and other projects. It has
 
 - **vs. Custom Scripts:** 10-20x faster due to optimized plugin execution
 - **vs. Serial Validation:** 2-5x faster with parallel execution mode
-- **vs. LangChain:** Smaller bundle footprint (live Bundlephobia tracking)
+- **vs. LangChain:** Smaller bundle footprint ([bundlephobia](https://bundlephobia.com/package/@dcyfr/ai))
 
 [⬆️ Back to top](#dcyfr-ai)