All notable changes to this project will be documented in this file. The format follows Keep a Changelog, and versions follow Semantic Versioning.
0.1.3 (2026-07-31)
- enforce bounded publication replay (05041c4)
- harden post-publication convergence (d02b87d)
- harden post-publication convergence (c4b930d)
- update examples to gpt-5.6-sol (3809692)
- update examples to gpt-5.6-sol (cae4c97)
0.1.2 (2026-07-31)
- bind publication to one current-main attempt (553d320)
- dispatch recovery from immutable tag (5f49304)
- dispatch recovery from immutable tag (c506ce2)
- harden options and publication contracts (1d62b52)
- harden options and publication contracts (c0934cc)
- harden release preparation and publish handoff (37b811c)
- harden release preparation and publish handoff (787f52f)
- recover exact publish artifact (22c313d)
- recover exact publish artifact (525d4d0)
- recover publish from immutable tag (8a80d82)
- recover publish from immutable tag (aa4c3ca)
- reject duplicate recovery dispatches (11871d9)
- remove the one-time release recovery path (c556624)
- remove the one-time v0.1.1 recovery path (c319503)
0.1.1 (2026-07-29)
- classify Release Please push state (505c7e9)
- classify Release Please push state (a7a03de)
- enforce options boundary and patch release flow (91ce99c)
- enforce options boundary and patch release flow (abf21ba)
- finalize Release Please patch state (3180b52)
- finalize Release Please patch state (453135e)
- harden options and Release Please patch flow (5b03072)
- harden Release Please patch releases (a33c128)
- limit Release Please push trigger (fbd5a22)
- match Release Please root title (0963e0e)
- match Release Please root title (300ffac)
- recover exact Release Please runs (4ffee49)
- require refreshed release candidate (ab5aa26)
- snapshot supported client options once (6ee0fdf)
0.1.0 (2026-07-28)
- Accepted the fixed authentication sentinel value injected by
actions/setup-nodefor npm Trusted Publishing while continuing to reject real registry token credentials. - Replaced the unpublished immutable alpha.2 release after its publication guard failed before invoking npm.
- Removed the one-time alpha.1 token bootstrap and manual recovery workflow after configuring npm Trusted Publishing.
- Required the release workflow to publish through OIDC without registry token credentials while preserving exact-artifact and provenance verification.
CometAPIas the public TypeScript and Node.js client.- Tested 0.1 contracts for Chat Completions, Responses, and Models.
- Streaming and non-streaming Chat Completions and Responses behavior.
- ESM and CommonJS package entry points and declarations.
- Mocked contracts, packed-artifact fixtures, OpenAI dependency deduplication,
and
APIErroridentity verification. - Standalone repository documentation and release verification commands.
- Targeted the official OpenAI JavaScript dependency range
^6.47.0. - Aligned configuration validation with the official
OpenAIErrorfamily while preserving the officialAPIErrorfamily for HTTP failures. - Derived release validation from
package.jsonand required agreement with the lock root, Release Please manifest or bootstrap state, changelog, tag, GitHub release, and packed metadata at the applicable release stage. - Applied the canonical CometAPI author, copyright, homepage, repository, bugs, support, conduct, and security identity.
- Made Public Preview and publication validation fail closed on canonical identity, public-safe standalone content, and release-ready status at the applicable gate.
- Added standalone-content scanning to the aggregated Public Preview gate and
encoded the protected, opt-in npm token bootstrap for
0.1.0-alpha.1only. - Hardened pre-visibility evidence by scanning tracked files and reachable Git
history for credential patterns, verifying an exact clean
HEADcopy, requiring substantive public documentation, and exercising every documented live-smoke stream failure state with mocked transport. - Made the release workflow the sole npm dist-tag source: prereleases use
next, stable releases uselatest, and the package manifest has no static dist-tag. - Limited the supported
enginesrange to Node.js 22 and 24. Node.js 26 remains advisory outside that range; Node.js 18 and 20 remain unsupported. - Limited the trusted live smoke to exactly three sequential requests, at most 16 output tokens per request, a 60-second timeout per request, concurrency one, and an immediate stop on the first failure.
- Completed the Public Preview repository transition, protected configuration, and authorized live-smoke verification before Registry Alpha publication.
CODEOWNERSand its validation dependencies until a real multi-maintainer model exists.- Unsupported legacy client aliases.