@zof-ai/api-contract-check 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.1.1
+
+Document public installation, executable entry points and reproducible packaged examples. Align release dependency pins; runtime behavior is unchanged.
+
 ## 0.1.0 (unreleased)
 
-Initial independently authored local implementation. Candidate package/repository names and Apache-2.0 licensing require owner and legal approval before publication.
+Initial independently authored public implementation, distributed under Apache-2.0.

package/README.md

@@ -2,13 +2,42 @@
 
 Compare local OpenAPI 3.0/3.1 JSON contracts or a supported JSON Schema subset. Findings explain endpoint/method removal, required inputs, incompatible request/response types, constraints, media types and authentication changes. The implementation is independently authored and works offline without a Zof account.
 
+<!-- ZOF_NPM_INSTALL_START -->
+## Install from npm
+
+Use Node.js 22 or 24 and npm. File-based operations require Linux or macOS with Python 3.10 or newer; Windows file operations fail closed. In a new project directory, install the version used by this guide:
+
+```sh
+npm install --ignore-scripts --save-exact @zof-ai/api-contract-check@0.1.1
+npx --no-install zof-api-contract-check --help
+```
+
+The package includes compiled JavaScript, TypeScript declarations and its runtime dependencies. No source build, Zof account or repository upload is required. `--ignore-scripts` disables installation lifecycle scripts; `--no-install` keeps the example commands from downloading another package.
+
+Confirm the public ESM entry point; this prints `function`:
+
+```sh
+node --input-type=module -e "import('@zof-ai/api-contract-check').then(api => console.log(typeof api.compareContracts))"
+```
+
+Run a packaged example from the same directory:
+
+```sh
+npx --no-install zof-api-contract-check baseline.json compatible.json --root node_modules/@zof-ai/api-contract-check/examples --kind openapi --json
+```
+
+The compatible OpenAPI example reports `compatible: true`; the breaking example described below exits 1.
+
+Package: [@zof-ai/api-contract-check](https://www.npmjs.com/package/@zof-ai/api-contract-check). The source-checkout instructions and three additional workflows follow.
+<!-- ZOF_NPM_INSTALL_END -->
+
 <!-- ZOF_RELEASE_INSTALL_START -->
 ## Install from GitHub source
 
 Requires Node.js 22 or 24, npm, and Git. Filesystem operations require Linux or macOS with Python 3.10 or newer; Windows file operations fail closed. Clone this repository and explicitly prepare its reviewed release dependencies:
 
 ```sh
-git clone https://github.com/Zof-AI/zof-api-contract-check.git
+git clone --branch v0.1.1 --depth 1 https://github.com/Zof-AI/zof-api-contract-check.git
 cd zof-api-contract-check
 node scripts/bootstrap.mjs --allow-network
 npm ci --ignore-scripts --prefer-offline
@@ -16,9 +45,8 @@ npm run build
 npm test
 ```
 
-The bootstrap downloads only the exact `v0.1.0` dependency assets from [GitHub Releases](https://github.com/Zof-AI/zof-api-contract-check/releases), as listed in `scripts/release-dependencies.json`, verifies SHA256 and byte size, and adds them to the npm cache. It does not extract archives, run package scripts, collect application data, or send credentials. Downloads require the explicit flag and follow only HTTPS GitHub asset redirects. Installation then fetches ordinary third-party dependencies from npm. Use a writable npm cache; set `npm_config_cache` consistently for both commands if needed. An unavailable asset, changed hash, or oversized response stops installation.
+The bootstrap downloads only the exact versioned dependency assets from [GitHub Releases](https://github.com/Zof-AI/zof-api-contract-check/releases), as listed in `scripts/release-dependencies.json`, verifies SHA256 and byte size, and adds them to the npm cache. It does not extract archives, run package scripts, collect application data, or send credentials. Downloads require the explicit flag and follow only HTTPS GitHub asset redirects. Installation then fetches ordinary third-party dependencies from npm. Use a writable npm cache; set `npm_config_cache` consistently for both commands if needed. An unavailable asset, changed hash, or oversized response stops installation.
 
-GitHub source and release artifacts are the initial distribution channel. These instructions do not claim that `@zof-ai` packages are published on npm or that the VS Code extension is listed in Marketplace.
 <!-- ZOF_RELEASE_INSTALL_END -->
 
 ## Local installation

package/dist/cli.js

@@ -7,7 +7,7 @@ try {
         console.log("zof-api-contract-check BASELINE.json CANDIDATE.json [--root DIR] [--kind openapi|json-schema] [--policy POLICY.json] [--json|--markdown]\nOffline JSON contracts. Exit 0: completed below threshold; 1: findings; 2: invalid/unsupported input.");
     }
     else if (args.includes("--version"))
-        console.log("0.1.0");
+        console.log("0.1.1");
     else {
         let root = process.cwd(), format = "markdown", policy, kind;
         const files = [];

package/docs/RELEASE.md

@@ -1,12 +1,12 @@
 # Release process
 
-Version 0.1.0 is prepared under [Apache-2.0](../LICENSE). [GitHub Releases](https://github.com/Zof-AI/zof-api-contract-check/releases) is the initial distribution channel. Refer to the release's actual assets and commit SHA; these instructions are not evidence that an upload or installation succeeded.
+Version 0.1.1 is distributed under [Apache-2.0](../LICENSE). [GitHub Releases](https://github.com/Zof-AI/zof-api-contract-check/releases) provides versioned source and reviewed build artifacts. Install `@zof-ai/api-contract-check@0.1.1` using the [npm quickstart](../README.md#install-from-npm). Refer to the release assets, commit SHA and recorded validation for the exact version.
 
 Start with the [source installation](../README.md#install-from-github-source). Run `node scripts/bootstrap.mjs --allow-network`, `npm ci --ignore-scripts --prefer-offline`, `npm run build`, `npm test`, and `npm pack --ignore-scripts`. The bootstrap checks the exact dependency release SHA256 and byte sizes. Do not replace failed checks with an unverified dependency or a `file:` reference in published metadata.
 
 Before releasing a new version, inspect source and Git history, dependency licenses, build outputs and every package entry. Resolve security findings; run independent negative and installation tests. Record artifact SHA256 and release commits. Maintain branch protection, private vulnerability reporting, least-privilege workflows and a protected release environment. The manual release-candidate workflow builds artifacts and does not publish automatically. Material release changes require a new review.
 
-Publish the reviewed package tarball as a GitHub Release asset. npm registry publication requires independently verified `@zof-ai` scope ownership and an authenticated publisher. Registry publication and registry install acceptance are not claimed by a GitHub release.
+Publish the reviewed package tarball as a GitHub Release asset. npm registry publication requires independently verified `@zof-ai` scope ownership and an authenticated publisher. Verify the registry version and integrity, then run the README commands in a fresh project before recording registry acceptance.
 
 After publication, retrieve assets anonymously, verify their checksums, install in a clean project, and execute documented examples. Check every intended distribution channel separately. Missing or unrun acceptance is not a pass. Hosted Zof integration remains unavailable until an approved public contract and real service acceptance exist.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zof-ai/api-contract-check",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Bounded offline OpenAPI and JSON Schema compatibility analysis",
   "type": "module",
   "main": "./dist/index.js",
@@ -57,6 +57,6 @@
     "@types/node": "22.19.11"
   },
   "dependencies": {
-    "@zof-ai/evidence-spec": "0.1.0"
+    "@zof-ai/evidence-spec": "0.1.1"
   }
 }