Document verified public npm v0.2.0 release and fix registry indexing timeout

.github/workflows/publish-npmjs.yml

@@ -68,13 +68,21 @@ jobs:
       - name: Confirm public registry metadata
         run: |
           set -euo pipefail
-          for attempt in 1 2 3 4 5; do
-            if npm view '@firexcore/agent-orbs@0.2.0' version --registry=https://registry.npmjs.org/ 2>/dev/null | grep -Fxq '0.2.0'; then
-              npm view '@firexcore/agent-orbs@0.2.0' dist.tarball repository.url --registry=https://registry.npmjs.org/
-              echo 'PUBLIC_NPMJS_VERIFIED'
+          url='https://registry.npmjs.org/%40firexcore%2Fagent-orbs/0.2.0'
+          # npm may return success while its public metadata is still processing.
+          for attempt in $(seq 1 36); do
+            http="$(curl --silent --show-error --location --max-time 12 --output /tmp/agent-orbs-public.json --write-out '%{http_code}' "$url" || true)"
+            if [[ "$http" == '200' ]] && node - <<'NODE'
+          const p=require('/tmp/agent-orbs-public.json');
+          const repo=typeof p.repository==='string'?p.repository:p.repository?.url||'';
+          if(p.name!=='@firexcore/agent-orbs'||p.version!=='0.2.0'||!p.dist?.tarball?.startsWith('https://registry.npmjs.org/')||!repo.includes('github.com/FireXCore/agent-orbs'))process.exit(1);
+          console.log('PUBLIC_NPMJS_VERIFIED',p.name,p.version,p.dist.tarball);
+          NODE
+            then
               exit 0
             fi
-            sleep 3
+            echo "Public registry processing: HTTP $http, attempt $attempt / 36"
+            sleep 10
           done
-          echo 'Registry verification failed' >&2
+          echo 'Public npm registry metadata did not become available' >&2
           exit 1

CHANGELOG.md

@@ -9,7 +9,7 @@
 - Provides pointer/touch interaction, light/dark themes, animation speed, pause and reduced-motion handling.
 - Includes the production demo, source documentation, geometry and compatibility tests.
 - Retains the upstream license and attribution in `third_party/thinking-orbs/`.
-- Publishes a GitHub Packages npm installable package and release tarball. Publishing to npmjs.org remains separate.
+- Published to **npmjs.org** as public `@firexcore/agent-orbs@0.2.0`, as well as GitHub Packages and the GitHub Release tarball. Public registry visibility verified.
 
 ## v0.1.0 — Initial public library
 

README.md

@@ -176,21 +176,27 @@ Make the selected `state` reflect an actual action: for example, only display `l
 
 ## Releases
 
-- **Latest release:** [v0.1.0](https://github.com/FireXCore/agent-orbs/releases/tag/v0.2.0)
+- **Latest release:** [v0.2.0](https://github.com/FireXCore/agent-orbs/releases/tag/v0.2.0)
 - **Downloadable distributable:** [firexcore-agent-orbs-0.2.0.tgz](https://github.com/FireXCore/agent-orbs/releases/download/v0.2.0/firexcore-agent-orbs-0.2.0.tgz)
 - **Changelog:** [CHANGELOG.md](CHANGELOG.md)
 - **Interactive demo:** [agent-orbs-demo.vercel.app](https://agent-orbs-demo.vercel.app/)
 
-The v0.2.0 tarball is attached to the GitHub Release. The library is published as **`@firexcore/agent-orbs@0.2.0`** on the [GitHub Packages npm registry](https://npm.pkg.github.com/) (not npmjs.org). GitHub Packages requires authenticated npm access; visibility is controlled in the GitHub Packages settings. The npmjs.org registry is a separate publication channel.
-
-To install with GitHub Packages authorization already configured (a GitHub token with package read permission may be required):
+**Public npmjs.org:** [@firexcore/agent-orbs@0.2.0](https://www.npmjs.com/package/@firexcore/agent-orbs) — confirmed in the public npm registry. Install without any GitHub Packages authentication:
 
 ```bash
-npm config set @firexcore:registry https://npm.pkg.github.com
 npm install @firexcore/agent-orbs@0.2.0
 ```
 
-See [GitHub's npm registry authentication guide](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-npm-registry).
+If you previously configured `@firexcore` to use GitHub Packages, remove the old registry override before installing from npmjs.org:
+
+```bash
+npm config delete @firexcore:registry
+npm install @firexcore/agent-orbs@0.2.0 --registry=https://registry.npmjs.org/
+```
+
+The GitHub release [v0.2.0](https://github.com/FireXCore/agent-orbs/releases/tag/v0.2.0) also provides the downloadable `.tgz`. The same version remains available separately through GitHub Packages for authenticated users.
+
+**Provenance note:** The initial public npmjs release was published without Sigstore provenance because duplicate transparency-log entry `TLOG_CREATE_ENTRY_ERROR (409)` blocked earlier publish attempts. Future releases should restore provenance using npm Trusted Publishing (OIDC) after resolving the upstream signing issue. CI and package build tests passed, and independent public-registry metadata verification succeeded.
 
 ## Attribution
 

docs/PUBLIC_NPMJS.md

@@ -2,7 +2,7 @@
 
 GitHub Packages (`npm.pkg.github.com`) and the public npm registry (`registry.npmjs.org`) are separate. The repository's source version is `@firexcore/agent-orbs@0.2.0`; publishing there requires control of the `@firexcore` npmjs scope.
 
-The publish workflow is `.github/workflows/publish-npmjs.yml`. It checks the package/version and source repository, builds, runs tests, confirms required ESM/CJS exports and upstream license notices, runs `npm pack --dry-run`, and publishes with `--access public --provenance`. It verifies public registry metadata before reporting success. It does not modify the GitHub Packages release.
+The publish workflow is `.github/workflows/publish-npmjs.yml`. It checks the package/version and source repository, builds, runs tests, confirms required ESM/CJS exports and upstream license notices, runs `npm pack --dry-run`, and publishes with `--access public`. For the initial 0.2.0 release, provenance is temporarily disabled in the workflow because a duplicate Sigstore transparency-log entry returned 409. It verifies public registry metadata with delayed polling before reporting success. It does not modify the GitHub Packages release.
 
 ## Authentication
 
@@ -22,11 +22,15 @@ Once authenticated, a push changing the workflow on `main` runs the publish auto
 
 ## Status and verification
 
-The GitHub Actions run must finish successfully and emit `PUBLIC_NPMJS_VERIFIED`. Independently verify at https://www.npmjs.com/package/@firexcore/agent-orbs and by using:
+**Published:** `@firexcore/agent-orbs@0.2.0` is available on the public npm registry. The independent [registry verification job](https://github.com/FireXCore/agent-orbs/actions/runs/41674994651) emitted `PUBLIC_NPMJS_VERIFIED` after npm completed indexing. The initial publish workflow returned a false failure because its original 15-second verification window was shorter than npm's metadata processing delay. The verification window is now extended to 6 minutes.
+
+Independently verify at https://www.npmjs.com/package/@firexcore/agent-orbs and by using:
 
 ```bash
 npm view @firexcore/agent-orbs@0.2.0 version --registry=https://registry.npmjs.org/
 npm install @firexcore/agent-orbs@0.2.0 --registry=https://registry.npmjs.org/
 ```
 
 Do not claim npmjs publication solely because GitHub CI, GitHub Packages or Vercel succeeded.
+
+For subsequent releases, move from long-lived `NPM_TOKEN` to npm Trusted Publishing and restore provenance after confirming the Sigstore duplicate-entry issue is resolved. Token revocation should follow a tested OIDC transition.