diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 17473a2..466df71 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.1.0-alpha.3" + ".": "0.1.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index ee56c89..da6c22a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to this project will be documented in this file. The format follows Keep a Changelog, and versions follow Semantic Versioning. +## [0.1.0](https://github.com/cometapi-dev/cometapi-node/compare/v0.1.0-alpha.3...v0.1.0) (2026-07-28) + +### Bug Fixes + +- prepare 0.1.0 stable release ([#27](https://github.com/cometapi-dev/cometapi-node/issues/27)) ([f5f6731](https://github.com/cometapi-dev/cometapi-node/commit/f5f6731ba9a5bb0fbfdc1ed256c3e66e3c03ca96)) + ## [Unreleased] ## [0.1.0-alpha.3] - 2026-07-27 diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index e3698c1..10a644d 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -3,6 +3,9 @@ Compatibility document version: 0.1 Package line: `0.1.x` +Stable candidate: `0.1.0`; publication and registry verification remain +separate evidence until the immutable release workflow completes. + This matrix defines the contract-tested 0.1 compatibility surface. Inheritance from the official OpenAI client does not by itself establish CometAPI support. Release and live-compatibility claims require their corresponding CI, registry, @@ -91,7 +94,8 @@ npm run test:compat npm run verify ``` -These are offline or mocked checks. Live compatibility requires the separately +These are offline or mocked checks. Stable candidate verification also runs the +minimum, locked, and latest-compatible OpenAI 6.x lanes. Live compatibility requires the separately gated trusted workflow described in [RELEASING.md](./RELEASING.md). A successful HTTP status alone is transport evidence, not proof that streaming, types, errors, and cancellation behave correctly. Each authorized live run remains diff --git a/README.md b/README.md index a70367b..9f8253e 100644 --- a/README.md +++ b/README.md @@ -4,9 +4,9 @@ The official CometAPI entry point for the OpenAI-compatible API. The SDK keeps the official OpenAI JavaScript request, response, stream, and error types while defaulting the client to CometAPI. -> **Registry Alpha pre-release:** the SDK is under active 0.1 development. -> `0.1.0-alpha.3` is available from npm under the `next` dist-tag, and its API -> may change before `0.1.0`. +> **Stable 0.1 release candidate:** `0.1.0` is approved for npm publication. +> The supported API is limited to the contract-tested 0.1 surface documented +> here and in [COMPATIBILITY.md](./COMPATIBILITY.md). ## Supported 0.1 surface @@ -37,10 +37,11 @@ files. You are responsible for all usage and charges incurred with your key. ## Installation -Install the prerelease from npm's `next` dist-tag: +Install the stable package from npm's default `latest` dist-tag after the +reviewed release completes: ```bash -npm install cometapi@next +npm install cometapi ``` The release workflow is the sole source of the npm dist-tag: prerelease @@ -52,9 +53,9 @@ For source-checkout testing, retain and verify one exact tarball: ```bash mkdir -p .artifacts npm pack --pack-destination .artifacts -npm run test:package -- --tarball .artifacts/cometapi-0.1.0-alpha.3.tgz -npm run test:examples -- --tarball .artifacts/cometapi-0.1.0-alpha.3.tgz -npm run test:fixtures -- --tarball .artifacts/cometapi-0.1.0-alpha.3.tgz +npm run test:package -- --tarball .artifacts/cometapi-0.1.0.tgz +npm run test:examples -- --tarball .artifacts/cometapi-0.1.0.tgz +npm run test:fixtures -- --tarball .artifacts/cometapi-0.1.0.tgz ``` Install that path in a separate consumer when needed. Do not treat a locally @@ -211,9 +212,10 @@ parent. ## Project status -The repository has completed Public Preview. Blocking CI, protected repository -rules, security reporting, protected environments, and the authorized live -smoke have passed. Registry Alpha `0.1.0-alpha.3` was published from the +The repository has completed Public Preview and Registry Alpha. Blocking CI, +protected repository rules, security reporting, protected environments, and +the authorized live smoke have passed. Stable `0.1.0` is the reviewed +publication candidate; Registry Alpha `0.1.0-alpha.3` was published from the immutable release artifact through GitHub Actions OIDC with provenance, and independent public-registry ESM, CommonJS, and compatible-OpenAI host installs passed. The immutable `0.1.0-alpha.2` GitHub release remains as an unpublished diff --git a/ROADMAP.md b/ROADMAP.md index 9c2920c..c6ceff8 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -5,6 +5,10 @@ Last updated: 2026-07-28 Repository contract: This roadmap is self-contained and is the public source of truth for this repository's release sequence. +The reviewed `0.1.0` release candidate is prepared. It becomes released only +after the immutable GitHub Release, bounded live smoke, OIDC publication, +provenance, signature, and public-install checks all pass. + ## Product Target The TypeScript and Node.js SDK will provide a typed CometAPI entry point that diff --git a/SECURITY.md b/SECURITY.md index 7a95a18..b6f1585 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,13 +2,15 @@ ## Release status -The SDK is in pre-release development. Published support claims begin only -after a package is independently verified from npm. +The stable 0.1 line receives security fixes for the documented supported +surface. Published support claims apply only after a package is independently +verified from npm. -| Version | Status | -| ------------------- | ----------------------------------------------------- | -| `0.1.x` prereleases | Best-effort security fixes after verified publication | -| Older versions | Unsupported | +| Version | Status | +| ----------------------- | --------------------------------------------------- | +| Latest stable `0.1.x` | Security fixes for the documented supported surface | +| Registry Alpha versions | Best-effort fixes after verified publication | +| Older versions | Unsupported | ## Reporting a vulnerability @@ -34,7 +36,7 @@ and redact request headers and logs. ## Response expectations CometAPI handles reports privately and coordinates disclosure after a fix or -mitigation is ready. Response times are not guaranteed for prereleases. +mitigation is ready. Response times are not guaranteed. ## Credential safety diff --git a/SUPPORT.md b/SUPPORT.md index 1115d1f..3a042cc 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -48,4 +48,4 @@ Useful reports answer: 4. Which exact `cometapi`, `openai`, and Node.js versions are installed? 5. Does `npm ls openai --all` show more than one effective installation? -Response times are not guaranteed for prereleases. +Response times are not guaranteed. diff --git a/examples/README.md b/examples/README.md index 4920343..b868495 100644 --- a/examples/README.md +++ b/examples/README.md @@ -13,10 +13,10 @@ live API without an explicit request budget and authorization. The transport against the exact packed tarball; mocked execution is package evidence, not live compatibility evidence. -Registry Alpha is available under npm's `next` dist-tag: +For the stable `0.1.x` line: ```bash -npm install cometapi@next +npm install cometapi COMETAPI_KEY="your-api-key" node examples/esm.mjs COMETAPI_KEY="your-api-key" node examples/commonjs.cjs ``` diff --git a/package-lock.json b/package-lock.json index 45c1708..ee4f86f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "cometapi", - "version": "0.1.0-alpha.3", + "version": "0.1.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "cometapi", - "version": "0.1.0-alpha.3", + "version": "0.1.0", "license": "MIT", "dependencies": { "openai": "^6.47.0" diff --git a/package.json b/package.json index 3d24a03..6ce28fc 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "cometapi", - "version": "0.1.0-alpha.3", + "version": "0.1.0", "description": "Official TypeScript and Node.js client for the CometAPI OpenAI-compatible API", "author": "CometAPI", "license": "MIT",