modelpact 2.0.2 → 2.0.4

package/README.md

@@ -234,9 +234,16 @@ const provider = name === null ? null : PROVIDERS[name];
 **Versioned, and released by machine.** Semantic versioning from conventional
 commits: [release-please](https://github.com/googleapis/release-please) opens
 the release PR, [`CHANGELOG.md`](CHANGELOG.md) is written from the history, and
-the tagged tree is what `npm publish` builds, with provenance. A `!` in a commit
-is a major, and 2.0 was one — four public names changed for the better, and the
-changelog says which.
+the tagged tree is what `npm publish` builds. A `!` in a commit is a major, and
+2.0 was one — four public names changed for the better, and the changelog says
+which.
+
+**Published without a key.** npm trusts this repository and this workflow file
+by name, so the release job signs in with its own OIDC identity and a
+credential that lives for one publish. There is no long-lived token to leak,
+and every version carries a
+[provenance attestation](https://docs.npmjs.com/generating-provenance-statements)
+saying which commit and which workflow built it.
 
 **Small on purpose.** ESM only, zero runtime dependencies, and the whole entry
 is 13.6 kB minified, 4.9 kB gzipped, before tree-shaking takes the providers
@@ -353,19 +360,15 @@ it. Vitest deliberately misses it — `include` there is `*.test.ts`.
 
 ## Contributing
 
-Conventional commits — release-please reads them — and a pull request against
-`main`; CI is the reviewer that has to say yes first. Everything it runs, runs
-locally:
-
-```sh
-npm ci
-npm run typecheck && npm run lint && npm run format:check && npm test
-npm run test:e2e            # Chromium; the demo server starts itself
-npm run external && npm run external:orchestrator && npm run external:agent
-```
+A backend is the most useful thing to bring: four answers, `createProvider`,
+and `describeContract` green. [`CONTRIBUTING.md`](CONTRIBUTING.md) has the
+setup, every check CI runs and how to run it first, the commit convention, the
+two rules the conformance suite will otherwise find for you, and where a change
+belongs among the three storeys.
 
-A backend is the most useful thing to bring. Four answers, `createProvider`,
-and `describeContract` green — see [Bring your own backend](#bring-your-own-backend).
+[`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md) is the short version of be decent.
+[`SECURITY.md`](SECURITY.md) is how to report a vulnerability privately, and
+what this package does and does not do with what a model says.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modelpact",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "A contract for language-model backends, and the test suite that proves yours conforms to it",
   "keywords": [
     "llm",