Merge branch 'main' into dependabot/github_actions/actions/download-artifact-8.0.1

Author: tensornull

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.1.0-alpha.2"
+  ".": "0.1.0-alpha.3"
 }

CHANGELOG.md

@@ -5,6 +5,16 @@ follows Keep a Changelog, and versions follow Semantic Versioning.
 
 ## [Unreleased]
 
+## [0.1.0-alpha.3] - 2026-07-27
+
+### Fixed
+
+- Accepted the fixed authentication sentinel value injected by
+  `actions/setup-node` for npm Trusted Publishing while continuing to reject
+  real registry token credentials.
+- Replaced the unpublished immutable alpha.2 release after its publication
+  guard failed before invoking npm.
+
 ## [0.1.0-alpha.2] - 2026-07-27
 
 ### Changed

README.md

@@ -5,8 +5,8 @@ the official OpenAI JavaScript request, response, stream, and error types while
 defaulting the client to CometAPI.
 
 > **Registry Alpha pre-release:** the SDK is under active 0.1 development.
-> `0.1.0-alpha.2` is approved for npm publication under the `next` dist-tag,
-> and its API may change before `0.1.0`.
+> `0.1.0-alpha.3` is available from npm under the `next` dist-tag, and its API
+> may change before `0.1.0`.
 
 ## Supported 0.1 surface
 
@@ -52,8 +52,8 @@ For source-checkout testing, retain and verify one exact tarball:
 ```bash
 mkdir -p .artifacts
 npm pack --pack-destination .artifacts
-npm run test:package -- --tarball .artifacts/cometapi-0.1.0-alpha.2.tgz
-npm run test:fixtures -- --tarball .artifacts/cometapi-0.1.0-alpha.2.tgz
+npm run test:package -- --tarball .artifacts/cometapi-0.1.0-alpha.3.tgz
+npm run test:fixtures -- --tarball .artifacts/cometapi-0.1.0-alpha.3.tgz
 ```
 
 Install that path in a separate consumer when needed. Do not treat a locally
@@ -210,9 +210,12 @@ parent.
 
 The repository has completed Public Preview. Blocking CI, protected repository
 rules, security reporting, protected environments, and the authorized live
-smoke have passed. Registry Alpha `0.1.0-alpha.1` is available from npm, and
-`0.1.0-alpha.2` is approved for OIDC publication. Mocked responses, packed
-artifacts, GitHub Actions, trusted live tests, and npm publication remain
+smoke have passed. Registry Alpha `0.1.0-alpha.3` was published from the
+immutable release artifact through GitHub Actions OIDC with provenance, and
+independent public-registry ESM, CommonJS, and compatible-OpenAI host installs
+passed. The immutable `0.1.0-alpha.2` GitHub release remains as an unpublished
+failure record because its guard stopped before invoking npm. Mocked responses,
+packed artifacts, GitHub Actions, trusted live tests, and npm publication remain
 separate evidence layers and must not be represented as another.
 
 See:

RELEASING.md

@@ -9,7 +9,7 @@ Release status is evidence-based:
 | Local code-complete             | Required source, tests, documentation, metadata, fixtures, and workflows exist, and every applicable offline check passes.                                                   |
 | Private Remote Validation ready | Local gates pass, the sanitized history and maintainer-confirmed identity are complete, and real credential-free private default-branch CI passes.                           |
 | Public Preview ready            | After visibility changes, public-only repository rules, security reporting, environments, default-branch CI, the content gate, and authorized protected live smoke all pass. |
-| Registry Alpha candidate        | The exact `0.1.0-alpha.2` artifact passes package and clean-install gates.                                                                                                   |
+| Registry Alpha candidate        | The exact `0.1.0-alpha.3` artifact passes package and clean-install gates after preserving the unpublished immutable alpha.2 failure record.                                 |
 | Registry Alpha released         | The public npm artifact installs from the `next` channel, passes post-publication verification, and has verified provenance plus any documented one-time bootstrap evidence. |
 | Stable released                 | Every stable 0.1.0 local, remote, live, review, provenance, and registry gate has recorded evidence.                                                                         |
 
@@ -67,7 +67,7 @@ artifacts. Authorized maintainers must supply or approve:
 - Changes to the canonical identity and contact values listed above
 - Repository creation and visibility, branch/tag protections, environments,
   secrets, and environment approval policies
-- npm package ownership for the maintainer-confirmed `cometapi-team` account
+- npm package ownership for the maintainer-confirmed `cometapi_dev` account
   and Trusted Publisher configuration
 - A `COMETAPI_KEY`, request budget, and explicit authorization for live smoke
   tests
@@ -79,7 +79,7 @@ corresponding release gate. Do not invent it or replace it with a mock.
 
 The `cometapi` package exists in the public registry. Registry Alpha owner
 evidence is complete only when `npm owner ls cometapi` lists the
-maintainer-confirmed `cometapi-team` account; until then this remains a Registry
+maintainer-confirmed `cometapi_dev` account; until then this remains a Registry
 Alpha prerequisite.
 
 For the current Public Preview milestone, private topic pushes, pull requests,
@@ -302,11 +302,11 @@ dist-tag. Before authorizing release:
     company-controlled owner and verifies the resulting owner list:
 
     ```bash
-    npm owner add cometapi-team cometapi
+    npm owner add cometapi_dev cometapi
     npm owner ls cometapi
     ```
 
-    Record evidence that the output lists `cometapi-team`; Registry Alpha owner
+    Record evidence that the output lists `cometapi_dev`; Registry Alpha owner
     setup is incomplete until it does.
 
 12. Install `cometapi@next` from npm and run an independent import and mocked
@@ -337,14 +337,58 @@ one-time exception:
    publication; the bootstrap does not change or defer that requirement.
 5. A maintainer immediately configures OIDC, removes the environment variable
    and secret, revokes the token, and restricts token-based publishing.
-6. The project immediately prepares and publishes `0.1.0-alpha.2` through
-   OIDC, verifies its provenance and public installation, and confirms that
-   `next` resolves to `0.1.0-alpha.2`.
-7. The release record documents the exception and both public-install evidence
-   layers.
+6. The project prepared the immutable `0.1.0-alpha.2` GitHub release through
+   OIDC. Exact-artifact verification and the protected live smoke passed, but
+   the local publication guard rejected the fixed `actions/setup-node`
+   authentication placeholder before npm was invoked. No alpha.2 registry
+   artifact was published.
+7. Preserve that immutable failure record, prepare and publish
+   `0.1.0-alpha.3` through OIDC with regression coverage for the placeholder,
+   verify its provenance and public installation, and confirm that `next`
+   resolves to `0.1.0-alpha.3`.
+8. The release record documents the exception, the unpublished alpha.2
+   attempt, and both public-install evidence layers.
 
 This exception must never become a reusable source-controlled publishing path.
 
+## Registry Alpha release evidence
+
+Registry Alpha completed on 2026-07-27 with these independently auditable
+layers:
+
+- The one-time `0.1.0-alpha.1` bootstrap recovery published the exact artifact
+  with provenance in [GitHub Actions run 30251436832](https://github.com/cometapi-dev/cometapi-node/actions/runs/30251436832).
+- npm ownership lists both `tensornull <tensor.null@gmail.com>` and the
+  company-controlled `cometapi_dev <dev@cometapi.com>` account. The bootstrap
+  token was revoked, local npm authentication was removed, the protected `npm`
+  environment has no secrets or variables, and npm disallows token publishing.
+- The immutable `0.1.0-alpha.2` release passed exact-artifact verification and
+  protected live smoke in [run 30270656080](https://github.com/cometapi-dev/cometapi-node/actions/runs/30270656080),
+  then failed before invoking npm because the local publication guard rejected
+  the fixed `actions/setup-node` authentication placeholder. No alpha.2
+  registry artifact exists.
+- Pull request [#23](https://github.com/cometapi-dev/cometapi-node/pull/23)
+  added regression coverage for that placeholder while preserving rejection of
+  real registry credentials. Default-branch [CI run 30272606126](https://github.com/cometapi-dev/cometapi-node/actions/runs/30272606126)
+  passed before tagging.
+- The immutable [`v0.1.0-alpha.3` release](https://github.com/cometapi-dev/cometapi-node/releases/tag/v0.1.0-alpha.3)
+  completed exact-artifact verification, the bounded three-request live smoke,
+  OIDC publication, registry convergence, signature verification, dependency
+  deduplication, and public installation in [run 30272764488](https://github.com/cometapi-dev/cometapi-node/actions/runs/30272764488).
+- npm identifies the publisher as GitHub Actions using
+  `npm-oidc-no-reply@github.com`. The registry reports SLSA provenance v1 and
+  integrity
+  `sha512-dtzQOz0dxif74jJpu2fhfUVjiq6TLm3YkPydtsryHGxuU6usaLWTpcblky854T42TG+SbTApCgOoNJDMkEYIOg==`,
+  and Sigstore transparency-log index
+  [`2257566579`](https://search.sigstore.dev/?logIndex=2257566579).
+- Independent installs from the public registry passed for ESM, CommonJS, and a
+  host already declaring `openai@6.47.0`. The host resolved one effective
+  OpenAI installation and preserved `APIError instanceof` identity. Registry
+  signatures and attestations were verified with `npm audit signatures`.
+- The `next` dist-tag resolves to `0.1.0-alpha.3`. The registry-created `latest`
+  tag remains on `0.1.0-alpha.1`; it is outside the prerelease installation path
+  and remains explicit residual cleanup before stable publication.
+
 ## Stable 0.1.0 sequence
 
 ```text

ROADMAP.md

@@ -1,6 +1,6 @@
 # CometAPI TypeScript and Node.js SDK Roadmap
 
-Status: Public Preview complete; Registry Alpha OIDC closeout in progress
+Status: Public Preview and Registry Alpha complete; 0.1.0 stable planned
 Last updated: 2026-07-27
 Repository contract: This roadmap is self-contained and is the public source
 of truth for this repository's release sequence.
@@ -15,21 +15,24 @@ Private Remote Validation and Public Preview are complete for the sanitized
 repository. The repository is public with blocking CI, protected repository and
 tag rules, Private Vulnerability Reporting, protected environments, and
 authorized live-smoke evidence. The functional `0.1.0-alpha.1` prerelease is
-available from npm; Registry Alpha remains open until `0.1.0-alpha.2` completes
-the OIDC, provenance, ownership, and public-install verification sequence.
+available from npm. The immutable `0.1.0-alpha.2` GitHub release failed locally
+before invoking npm because its publication guard rejected the fixed
+`actions/setup-node` authentication placeholder. `0.1.0-alpha.3` completed the
+OIDC, provenance, ownership, and public-install verification sequence and is
+available from npm's `next` channel.
 
 ## Milestones
 
-| Milestone                  | Status      | User outcome                                                                                                                             |
-| -------------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
-| Repository foundation      | In progress | The repository has reproducible development, contribution, security, and release processes.                                              |
-| Private Remote Validation  | Complete    | The sanitized private repository passes real credential-free default-branch CI; public-only controls and live tests remain disabled.     |
-| Public Preview             | Complete    | The public repository has blocking CI, repository rules, security reporting, protected environments, and authorized live-smoke evidence. |
-| 0.1.x Registry Alpha       | In progress | Early adopters can install a functional prerelease from npm's `next` channel; alpha.2 must prove the OIDC-only publication path.         |
-| 0.1.0 Stable               | Planned     | Users can install a fully verified package from npm's default channel.                                                                   |
-| 0.2.0 provider-native text | Planned     | Users can opt into Anthropic Messages and Gemini text adapters through isolated subpath exports.                                         |
-| 0.3.0 CometAPI resources   | Planned     | Users receive typed access to the first stable CometAPI-specific account or platform resources.                                          |
-| Media and task APIs        | Later       | Users receive typed image, video, audio, upload, polling, and task lifecycle helpers after their contracts are stable.                   |
+| Milestone                  | Status      | User outcome                                                                                                                              |
+| -------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| Repository foundation      | In progress | The repository has reproducible development, contribution, security, and release processes.                                               |
+| Private Remote Validation  | Complete    | The sanitized private repository passes real credential-free default-branch CI; public-only controls and live tests remain disabled.      |
+| Public Preview             | Complete    | The public repository has blocking CI, repository rules, security reporting, protected environments, and authorized live-smoke evidence.  |
+| 0.1.x Registry Alpha       | Complete    | Early adopters can install a functional, provenance-verified prerelease from npm's `next` channel through the OIDC-only publication path. |
+| 0.1.0 Stable               | Planned     | Users can install a fully verified package from npm's default channel.                                                                    |
+| 0.2.0 provider-native text | Planned     | Users can opt into Anthropic Messages and Gemini text adapters through isolated subpath exports.                                          |
+| 0.3.0 CometAPI resources   | Planned     | Users receive typed access to the first stable CometAPI-specific account or platform resources.                                           |
+| Media and task APIs        | Later       | Users receive typed image, video, audio, upload, polling, and task lifecycle helpers after their contracts are stable.                    |
 
 ## Repository Foundation
 
@@ -339,9 +342,15 @@ npm does not allow configuration before the first package publication, only
    access and provenance, and verifies registry installation.
 4. A maintainer immediately configures Trusted Publishing, removes the variable
    and secret, revokes the token, and restricts token-based publishing.
-5. The project immediately publishes `0.1.0-alpha.2` through OIDC, verifies its
-   provenance and installation, and confirms that `next` resolves to
-   `0.1.0-alpha.2`.
+5. The project attempted to publish `0.1.0-alpha.2` through OIDC. Its immutable
+   GitHub release passed exact-artifact and live-smoke verification, but the
+   local publication guard rejected the fixed `actions/setup-node`
+   authentication placeholder before npm was invoked; no alpha.2 registry
+   artifact exists.
+6. The project preserved that immutable failure record and published
+   `0.1.0-alpha.3` through OIDC with regression coverage for the placeholder.
+   Provenance, registry signatures, independent installation, ownership, and
+   the `next` dist-tag were verified.
 
 This exception must be recorded in the release evidence and must never become
 a reusable publication path.

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "cometapi",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "description": "Official TypeScript and Node.js client for the CometAPI OpenAI-compatible API",
   "author": "CometAPI",
   "license": "MIT",

package.json

@@ -7,7 +7,11 @@ set -euo pipefail
 
 artifact_directory="${ARTIFACT_DIRECTORY:-release-artifacts}"
 
-if [[ -n "${NODE_AUTH_TOKEN:-}" || -n "${NPM_TOKEN:-}" ]]; then
+# actions/setup-node exports this fixed sentinel when registry-url is configured,
+# including the npm-documented Trusted Publishing workflow.
+setup_node_auth_placeholder="XXXXX-XXXXX-XXXXX-XXXXX"
+if [[ -n "${NPM_TOKEN:-}" ]] || \
+  [[ -n "${NODE_AUTH_TOKEN:-}" && "${NODE_AUTH_TOKEN}" != "$setup_node_auth_placeholder" ]]; then
   echo "Registry tokens are forbidden; publication must use npm Trusted Publishing." >&2
   exit 1
 fi

scripts/publish-artifact.sh

@@ -18,6 +18,7 @@ import { afterEach, describe, expect, it } from "vitest";
 const script = fileURLToPath(
   new URL("../scripts/publish-artifact.sh", import.meta.url),
 );
+const setupNodeAuthPlaceholder = "XXXXX-XXXXX-XXXXX-XXXXX";
 const temporaryDirectories = [];
 
 afterEach(() => {
@@ -62,7 +63,7 @@ function runPublish({
   distTag = "next",
   nodeAuthToken = "",
   npmToken = "",
-  version = "0.1.0-alpha.2",
+  version = "0.1.0-alpha.3",
 } = {}) {
   const { bin, log, root } = fixture();
   const result = spawnSync("bash", [script], {
@@ -96,6 +97,16 @@ describe("publish artifact authentication", () => {
     );
   });
 
+  it("allows the actions/setup-node authentication placeholder", () => {
+    const { log, result } = runPublish({
+      nodeAuthToken: setupNodeAuthPlaceholder,
+    });
+    expect(result.status, result.stderr).toBe(0);
+    expect(log).toMatch(
+      /^token-present\npublish .* --provenance --tag next\n$/,
+    );
+  });
+
   it.each([
     ["NODE_AUTH_TOKEN", { nodeAuthToken: "opaque" }],
     ["NPM_TOKEN", { npmToken: "opaque" }],