@functional-systems/lambdadb-mcp 0.1.0-dev.4 → 0.1.0

package/CHANGELOG.md

@@ -1,11 +1,12 @@
 # Changelog
 
-## Unreleased
+## [0.1.0] - 2026-09-20
 
-- Prepare `@functional-systems/lambdadb-mcp` and the `lambdadb-mcp` executable for npm/npx distribution under Apache-2.0.
-- Add gated OIDC publishing for develop, rc and stable channels with exact tarball consumer checks.
+- Package `@functional-systems/lambdadb-mcp` and the `lambdadb-mcp` executable for npm/npx distribution under Apache-2.0.
+- Add OIDC publishing for develop, rc and stable channels with exact tarball consumer checks; automatic dev publishing is enabled.
 - Derive the MCP server version from package metadata and close the process on stdio disconnect or termination.
 - Raise the supported Node.js floor to 22.14.0; verify the minimum and current Node 22/24 LTS.
 - Preserve the existing environment variables, read-only default and explicit write opt-in.
 - Require explicit development-project confirmation before running the optional live smoke.
 - Refresh compatible locked dependencies; the audited dependency tree has no known advisories at validation time.
+- Record successful npm-installed stdio and authorized development-service validation of the dev distribution.

package/CONTRIBUTING.md

@@ -39,7 +39,9 @@ by this change. Validation has read-only permissions and no service credentials.
 
 Keep develop's reviewed base in `X.Y.Z-dev.N` form. Automatic dev publication
 requires separate bootstrap, package-specific npm trust and an explicit repository
-variable; it is initially disabled. PRs and manual workflow runs cannot publish.
+variable. Setup is complete and `NPM_DEV_PUBLISH_ENABLED=true` as verified on
+2026-09-20 (KST); merging into develop can publish a new dev version after CI
+succeeds. PRs and manual workflow runs cannot publish.
 Follow [RELEASING.md](RELEASING.md) for every publication action.
 
 Prepare rc/stable metadata on a release branch and review it into `main`. Promote

package/README.md

@@ -14,9 +14,11 @@ MCP server for LambdaDB using the official TypeScript MCP SDK and the official L
 Package: `@functional-systems/lambdadb-mcp`. Executable: `lambdadb-mcp`.
 Requires Node.js >=22.14.0; CI tests the minimum and current Node 22/24 LTS.
 
-Publication is being prepared. The following commands become available after the
-maintainer completes [first publication and trust setup](RELEASING.md). Before
-there is a stable release, select `@dev` or an exact published prerelease:
+The package is published on the `dev` channel. Until a stable release exists,
+select `@dev` or an exact published prerelease. As verified on 2026-09-20 (KST),
+`dev` resolves to `0.1.0-dev.5`; `latest` still points to the bootstrap prerelease
+`0.1.0-dev.1` and does not indicate a stable release. See
+[release status and policy](RELEASING.md).
 
 ```sh
 npx --yes @functional-systems/lambdadb-mcp@dev
@@ -137,7 +139,7 @@ tarball in a clean consumer directory and repeats the tool contracts over real
 stdio, checking version identity, config errors, stdout and process termination.
 CI validates Node 22.14.0, current 22.x and 24.x on PRs and pushes to develop/main.
 See [CONTRIBUTING.md](CONTRIBUTING.md) and [RELEASING.md](RELEASING.md) for checks,
-release policy and the initially disabled automatic publication gate.
+release policy and the explicitly enabled automatic dev publication gate.
 
 For a live smoke, explicitly designate a disposable **development** project and
 configure its credentials in `.env.local` with `LAMBDADB_MCP_ENABLE_WRITE_TOOLS=true`.

package/RELEASING.md

@@ -2,13 +2,30 @@
 
 ## Status and policy
 
-This change prepares npm distribution; it does not publish a package, tag a
-release or enable automatic publication. On 2026-09-19, the public registry
-returned E404 for `@functional-systems/lambdadb-mcp`; GitHub had no tags or
-Releases. The current npm account returned E401 for both `npm whoami` and
-`npm org ls functional-systems`, so organization publication rights remain
-unconfirmed. GitHub repository administration is not npm organization membership.
-Check these again before bootstrap; a public E404 is not a name reservation.
+As verified on **2026-09-20 (KST)**:
+
+- Public package: [`@functional-systems/lambdadb-mcp`](https://www.npmjs.com/package/@functional-systems/lambdadb-mcp).
+- Manual bootstrap `0.1.0-dev.1` is complete. Organization publication rights were
+  confirmed during bootstrap; do not repeat first publication.
+- Package-specific Trusted Publishing is working: GitHub Actions published
+  `0.1.0-dev.4` with OIDC and provenance in
+  [run 35434355648, attempt 2](https://github.com/lambdadb/lambdadb-mcp/actions/runs/35434355648/attempts/2).
+- Automatic dev publication is enabled (`NPM_DEV_PUBLISH_ENABLED=true`). Eligible
+  develop pushes publish after validation; a documentation-only merge can also
+  produce a new dev version.
+- `dev=0.1.0-dev.5`; `latest=0.1.0-dev.1` is still the bootstrap prerelease.
+  There is no rc/stable release or GitHub Release yet. Prefer `@dev` or an exact
+  published version until stable is available.
+- The `0.1.0` stable candidate carries the publishing workflow and matching dated
+  release metadata for main review. Merging the candidate validates main but does
+  not publish a package. Publication requires the explicit GitHub release
+  `v0.1.0` with `prerelease: false`, which publishes to `latest`; see [explicit rc/stable publication](#explicit-rcstable-publication).
+- See the [validation record](https://github.com/lambdadb/lambdadb-mcp/blob/develop/docs/validation/2026-09-20-npm.md) for package,
+  provenance, and live-service evidence and their separate scopes.
+
+These are dated observations, not fixed channel values. Recheck the registry and
+repository variable before the next release. The bootstrap and trust sections
+below describe setup and recovery; they are not outstanding setup tasks.
 
 | Source | Version | Trigger | npm dist-tag |
 | --- | --- | --- | --- |
@@ -55,7 +72,10 @@ Live tests are optional for PR validation, but release owners must explicitly
 record performed or not performed. They require a designated development project,
 not merely the presence of an existing `.env.local` or credential. See README
 for `LAMBDADB_RUN_LIVE_TESTS=1` and project confirmation. Do not load production
-credentials into package/CI tests. This implementation task did not run live tests.
+credentials into package/CI tests. Authorized development-project live tests have
+passed; the [validation record](https://github.com/lambdadb/lambdadb-mcp/blob/develop/docs/validation/2026-09-20-npm.md) identifies the
+tested source and installed package. These results do not automatically validate
+a future release candidate.
 
 ## First package publication: separate manual bootstrap
 
@@ -112,8 +132,9 @@ It has no npm token secret. See [npm Trusted Publishing](https://docs.npmjs.com/
 Leave repository variable `NPM_DEV_PUBLISH_ENABLED` unset or false through
 bootstrap and trust setup. Only after authorizing ongoing develop publication,
 set it to `true` in GitHub **Settings → Secrets and variables → Actions → Variables**.
-This implementation leaves it unset. The next eligible develop push, or a rerun
-of its existing push workflow, can then publish. `workflow_dispatch`, PRs and main
+This repository completed that activation; the variable was verified as `true` on
+2026-09-20 (KST). The next eligible develop push, or a rerun of its existing push
+workflow, can publish. `workflow_dispatch`, PRs and main
 pushes validate only. Disable the variable to stop future automatic publication;
 do not cancel an in-progress registry write as rollback.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@functional-systems/lambdadb-mcp",
-  "version": "0.1.0-dev.4",
+  "version": "0.1.0",
   "private": false,
   "description": "MCP server for LambdaDB data plane",
   "type": "module",
@@ -60,5 +60,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org"
   },
-  "gitHead": "b79690aeccf4cfc87756153511dd286ff9ff7da1"
+  "gitHead": "29be7b9cca26c6e619e9f9ad689cca3663c09d46"
 }