@firetail/finchly 0.0.4 → 0.0.5

package/CHANGELOG.md

@@ -4,37 +4,28 @@ All notable changes to `@firetail/finchly`. Versions follow semver.
 
 ## Unreleased
 
-## 0.0.4 - 2026-11-12
-
-No change to the package. The first release published by the release
-workflow: 0.0.2 and 0.0.3 were tagged but did not reach npm, because the
-workflow published with a placeholder token in place of the trusted
-publisher. Everything listed under them arrives in this release.
+## 0.0.5 - 2026-11-12
 
-## 0.0.3 - 2026-11-12
+- The README covers using the SDK only. Notes for people working on the
+  SDK are no longer part of the package.
 
-Tagged but not published to npm.
+## 0.0.4 - 2026-11-12
 
 - Every request to the platform carries three headers: `x-platform-sdk`
   (the package name), `x-platform-sdk-version` (this release) and
   `x-platform-api-version` (the platform API version it speaks). A caller
   cannot replace them. Exported as `SDK_REQUEST_HEADERS`.
-
-## 0.0.2 - 2026-11-12
-
-Tagged but not published to npm.
-
 - An app can register itself: `createServiceClient` takes an `enrolment`
   (token, manifest, address) in place of a credential, and
   `enrolmentFrom(config, manifest)` builds one from the platform settings.
   Registration is what gets an app's instance key accepted.
 - New error codes: `app_pending_approval`, `app_registration_refused`.
 
+0.0.2 and 0.0.3 were not published.
+
 ## 0.0.1 - 2026-11-11
 
-The first release, published by hand so that the package exists and
-trusted publishing can be set up. Later releases come from the release
-workflow.
+The first release.
 
 - Package skeleton under its final name.
 - `loadConfig`: read and validate the `PLATFORM_*` settings.

package/README.md

@@ -1,6 +1,6 @@
 # @firetail/finchly
 
-Node SDK for the [Finchly](https://github.com/firetail-io/finchly) platform.
+Node SDK for the [Finchly](https://github.com/FireTail-io/finchly) platform.
 A service or app uses it to register with a Finchly deployment, verify who
 is calling it, and reach the platform's database, object store, queue and
 other services.
@@ -9,7 +9,7 @@ Status: early. The package builds and is tested, but only the first four
 modules exist.
 
 The SDK implements the platform API, which is specified in
-`firetail-io/finchly` under `spec/`. This release speaks platform API `v1`
+`FireTail-io/finchly` under `spec/`. This release speaks platform API `v1`
 (draft).
 
 ## Install
@@ -69,7 +69,7 @@ try {
 A token is rejected unless it is signed with ES256 by a key the gateway
 publishes, names that gateway as issuer and this service as its only
 audience, and has not expired. The rules are in `spec/identity-token.md` in
-`firetail-io/finchly`.
+`FireTail-io/finchly`.
 
 No other header is ever consulted. On a path the manifest declares in
 `publicPaths` there is no token, and the service authenticates the request
@@ -115,7 +115,7 @@ The instance makes an ES256 key pair in memory the first time it is needed.
 The private half never leaves the process. The public half is registered
 with the gateway using the credential the service was deployed with, and
 extended by itself for as long as the instance runs. The rules are in
-`spec/service-token.md` and `spec/registration.md` in `firetail-io/finchly`.
+`spec/service-token.md` and `spec/registration.md` in `FireTail-io/finchly`.
 
 ### An app registers itself
 
@@ -153,7 +153,7 @@ exactly as it was loaded. What can come back:
 | `app_registration_refused` | The platform refused, and `problems` says why: a bad token, a manifest or address it will not accept, a lower version than the one running | Fix the deployment. Trying again will not help |
 | `gateway_unreachable` | The gateway could not be reached | Try again |
 
-The protocol is in `spec/registration.md` in `firetail-io/finchly`.
+The protocol is in `spec/registration.md` in `FireTail-io/finchly`.
 
 The other half of the `app` module is not built: serving the
 `/{slug}/_platform/*` endpoints, which let an administrator register an app
@@ -168,7 +168,7 @@ release is asking:
 | Header | Value |
 |---|---|
 | `x-platform-sdk` | `@firetail/finchly` |
-| `x-platform-sdk-version` | This release, for example `0.0.4` |
+| `x-platform-sdk-version` | This release, for example `0.0.5` |
 | `x-platform-api-version` | The platform API version it speaks, `v1` |
 
 That covers fetching the gateway's issuer and keys, registering an instance
@@ -209,73 +209,6 @@ not leak them.
 The manifest check here is not the full schema. The platform runs the full
 check at registration and is the authority.
 
-## Develop
+## Changes
 
-```
-npm install
-npm test
-```
-
-`npm test` compiles with `tsc` and runs the tests in `test/` against the
-build, which is what a consumer imports.
-
-### Conformance vectors
-
-`test/conformance/` holds test vectors copied from `firetail-io/finchly`
-(`conformance/vectors/`). Both SDKs must reach the verdict each vector
-states. Do not edit them here: change them in `finchly`, regenerate, and
-copy the file to both SDK repositories. Until `finchly` publishes its
-conformance suite as an image, the copy is made by hand.
-
-## Release
-
-Each package version is semver, independent of the Python SDK and of the
-platform.
-
-1. Changes land on `main` by pull request. Each one adds a line to
-   `CHANGELOG.md` under "Unreleased".
-2. To release, set the version in `package.json`, move the changelog
-   entries under that version, merge, and tag the merge commit `vX.Y.Z`.
-3. The `release` workflow checks the tag matches `package.json`, runs the
-   tests, and publishes.
-4. A version with a pre-release part (`1.2.0-rc.1`) is published under the
-   `next` dist-tag. Anything else is published as `latest`.
-5. A bad release is deprecated with `npm deprecate` and followed by a patch
-   release. It is not unpublished.
-
-Publishing is meant to use npm trusted publishing: the workflow proves its
-identity to npm with its GitHub Actions token, so no npm token is stored,
-and npm attaches a provenance attestation.
-
-npm matches the trusted publisher against the identity GitHub issues to the
-workflow, and every field must match exactly, including case:
-
-| Field on npmjs.com   | Value         |
-| -------------------- | ------------- |
-| Organization or user | `FireTail-io` |
-| Repository           | `finchly-sdk-js` |
-| Workflow filename    | `release.yml` |
-| Environment name     | `npm`         |
-
-The organisation is `FireTail-io`, not `firetail-io`. GitHub accepts either
-spelling in a URL; npm does not, and answers "package not found" when the
-two differ. `repository.url` in `package.json` must use the same spelling.
-The workflow prints the identity it was issued, so a refusal can be compared
-with what npmjs.com holds. A trusted publisher's fields cannot be edited: to
-correct one, delete it and create another.
-
-The workflow can also be given a token, for a release that trusted
-publishing refuses:
-
-- `NPM_TOKEN`, a secret of the `npm` environment in this repository. It is
-  a granular access token that can publish `@firetail/finchly` and nothing
-  else, with a short expiry.
-- npm tries the trusted publisher first and uses the token only when that
-  is refused. Without the secret, nothing in the workflow needs to change.
-- While a token is in use, the package's "Publishing access" on npmjs.com
-  must allow a granular access token with bypass 2FA.
-- No provenance attestation is attached to a release published with the
-  token. npm also does not generate one from a private repository.
-
-Still to add: the conformance suite from `firetail-io/finchly`, run in CI on
-every change, once that suite exists.
+See `CHANGELOG.md`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firetail/finchly",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Node SDK for the Finchly platform",
   "type": "module",
   "main": "./dist/index.js",