@kb1rma/libcomm14cux-ts 0.0.0 → 0.1.0

package/README.md

@@ -1,4 +1,4 @@
-# comm14cux-ts
+# libcomm14cux-ts
 
 TypeScript library for communicating with the Lucas 14CUX engine ECU over its serial diagnostic port, using the Web Serial API.
 
@@ -12,10 +12,16 @@ The existing tool for this is [RoverGauge](https://github.com/colinbourassa/rove
 
 This project is not affiliated with or endorsed by the author of libcomm14cux or RoverGauge.
 
+## Installation
+
+```sh
+npm install @kb1rma/libcomm14cux-ts
+```
+
 ## Usage
 
 ```ts
-import { Ecu, WebSerialTransport, AirflowType } from 'comm14cux-ts';
+import { Ecu, WebSerialTransport, AirflowType } from '@kb1rma/libcomm14cux-ts';
 
 const port = await navigator.serial.requestPort();
 const ecu = new Ecu(new WebSerialTransport(port));
@@ -138,6 +144,26 @@ This project is therefore licensed under the **GNU General Public License v3.0 o
 
 Parts of this project were written with the help of an AI assistant. The original libcomm14cux and RoverGauge projects do not accept AI-generated contributions, so nothing from this repository will be submitted to them.
 
+## Verifying a release
+
+Every version is published from GitHub Actions with npm trusted publishing, and npm records a signed [SLSA provenance](https://slsa.dev/) statement for it (the "Built and signed on GitHub Actions" badge on the package page). In a project that depends on the package, `npm audit signatures` checks the registry signatures and the provenance.
+
+Each stable release also has three attestations signed with Sigstore and stored on this repository, all about the exact tarball published to npm:
+
+- SLSA build provenance: which workflow, commit and runner built it
+- a CycloneDX SBOM of its runtime dependencies
+- an in-toto test result listing the unit and acceptance tests that passed against it
+
+Download the tarball from the [release](https://github.com/KB1RMA/libcomm14cux-ts/releases) (or with `npm pack @kb1rma/libcomm14cux-ts@<version>`) and verify it with the [GitHub CLI](https://cli.github.com/):
+
+```sh
+gh attestation verify kb1rma-libcomm14cux-ts-<version>.tgz --repo KB1RMA/libcomm14cux-ts
+gh attestation verify kb1rma-libcomm14cux-ts-<version>.tgz --repo KB1RMA/libcomm14cux-ts \
+  --predicate-type https://in-toto.io/attestation/test-result/v0.1 --format json
+```
+
+The release also carries each attestation as a `.sigstore.json` bundle, so it can be checked offline with `--bundle`. Beta versions published under the `next` dist-tag have the npm provenance only.
+
 ## Development
 
 Requires Node.js (see `.nvmrc`).

package/dist/version.d.ts

@@ -13,6 +13,5 @@ export interface Version {
      */
     patch: number;
 }
-/** Must match `version` in package.json (enforced by a test). */
 export declare const LIBRARY_VERSION: Version;
 //# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAGA,oEAAoE;AACpE,MAAM,WAAW,OAAO;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,iEAAiE;AACjE,eAAO,MAAM,eAAe,EAAE,OAA0C,CAAC"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAGA,oEAAoE;AACpE,MAAM,WAAW,OAAO;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAQD,eAGA,MAAM,eAAe,EAAE,OAAiC,CAAC"}

package/dist/version.js

@@ -1,5 +1,9 @@
 // SPDX-License-Identifier: GPL-3.0-only
 // Copyright (C) 2026 comm14cux-ts contributors
-/** Must match `version` in package.json (enforced by a test). */
-export const LIBRARY_VERSION = { major: 0, minor: 0, patch: 0 };
+/** Updated by release-please; must match `version` in package.json (enforced by a test). */
+const PACKAGE_VERSION = '0.1.0'; // x-release-please-version
+const [major = 0, minor = 0, patch = 0] = PACKAGE_VERSION.split('.').map(Number);
+export /**
+ *
+ */ const LIBRARY_VERSION = { major, minor, patch };
 //# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,+CAA+C;AAkB/C,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAY,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC","sourcesContent":["// SPDX-License-Identifier: GPL-3.0-only\n// Copyright (C) 2026 comm14cux-ts contributors\n\n/** Major/minor/patch version of this library (`c14cux_version`). */\nexport interface Version {\n  /**\n   * Major version number.\n   */\n  major: number;\n  /**\n   * Minor version number.\n   */\n  minor: number;\n  /**\n   * Patch version number.\n   */\n  patch: number;\n}\n\n/** Must match `version` in package.json (enforced by a test). */\nexport const LIBRARY_VERSION: Version = { major: 0, minor: 0, patch: 0 };\n"]}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,+CAA+C;AAkB/C,4FAA4F;AAC5F,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,2BAA2B;AAE5D,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,GACrC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAEzC,MAAM,CAAC;;GAEJ,CACH,MAAM,eAAe,GAAY,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC","sourcesContent":["// SPDX-License-Identifier: GPL-3.0-only\n// Copyright (C) 2026 comm14cux-ts contributors\n\n/** Major/minor/patch version of this library (`c14cux_version`). */\nexport interface Version {\n  /**\n   * Major version number.\n   */\n  major: number;\n  /**\n   * Minor version number.\n   */\n  minor: number;\n  /**\n   * Patch version number.\n   */\n  patch: number;\n}\n\n/** Updated by release-please; must match `version` in package.json (enforced by a test). */\nconst PACKAGE_VERSION = '0.1.0'; // x-release-please-version\n\nconst [major = 0, minor = 0, patch = 0] =\n  PACKAGE_VERSION.split('.').map(Number);\n\nexport /**\n *\n */\nconst LIBRARY_VERSION: Version = { major, minor, patch };\n"]}

package/package.json

@@ -1,11 +1,11 @@
 {
 	"name": "@kb1rma/libcomm14cux-ts",
-	"version": "0.0.0",
+	"version": "0.1.0",
 	"description": "TypeScript library for communicating with the Lucas 14CUX engine ECU over a serial port using the Web Serial API",
 	"license": "GPL-3.0-only",
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/KB1RMA/comm14cux-ts.git"
+		"url": "git+https://github.com/KB1RMA/libcomm14cux-ts.git"
 	},
 	"type": "module",
 	"packageManager": "npm@11.8.0",

package/src/version.ts

@@ -17,5 +17,13 @@ export interface Version {
   patch: number;
 }
 
-/** Must match `version` in package.json (enforced by a test). */
-export const LIBRARY_VERSION: Version = { major: 0, minor: 0, patch: 0 };
+/** Updated by release-please; must match `version` in package.json (enforced by a test). */
+const PACKAGE_VERSION = '0.1.0'; // x-release-please-version
+
+const [major = 0, minor = 0, patch = 0] =
+  PACKAGE_VERSION.split('.').map(Number);
+
+export /**
+ *
+ */
+const LIBRARY_VERSION: Version = { major, minor, patch };