📄[Docs] v0.1.0 post-release cleanup

CHANGELOG.md

@@ -4,7 +4,7 @@ All notable changes will be documented here. The project intends to follow seman
 
 ## Unreleased
 
-## 0.1.0 - Release candidate
+## 0.1.0 - 2026-08-26
 
 ### Added
 

README.md

@@ -1,6 +1,6 @@
 # secure-metadata
 
-`secure-metadata` is a pre-release TypeScript library for deterministic, security-conscious inspection, cleaning, and verification of metadata in binary image formats. It is built for privacy-first, entirely local use with no analytics, telemetry, network access, runtime CDN, or pixel decoding.
+`secure-metadata` is a pre-1.0 TypeScript library for deterministic, security-conscious inspection, cleaning, and verification of metadata in binary image formats. It is built for privacy-first, entirely local use with no analytics, telemetry, network access, runtime CDN, or pixel decoding.
 
 ## Development status
 
@@ -22,11 +22,9 @@ JPEG supports bounded inspection, common TIFF/EXIF field decoding, cleaning, and
 
 ## Installation
 
-After publication, install from npm:
+The package is not currently published to npm. Source and release artifacts for `v0.1.0` are available from the [GitHub release](https://github.com/SecureToolsProject/Secure_Metadata/releases/tag/v0.1.0).
 
-    npm install secure-metadata
-
-Node.js 20 or newer is required. Browser consumers may import the secure-metadata/browser entry through a bundler, or deploy the versioned standalone browser artifact from the release candidate on the same origin. The library never loads code from a CDN.
+Node.js 20 or newer is required. Browser consumers can verify the released version, license, and SHA-256 checksum, then vendor the standalone browser artifact on the same origin. The library never loads code from a CDN.
 
 ## Public API
 
@@ -60,7 +58,7 @@ The library does not perform image decoding or encoding, visual redaction, pixel
 
 ## Secure Tools ecosystem
 
-This is an independent open-source library in the broader Secure Tools ecosystem. Future integration will use a pinned browser artifact rather than coupling application code to this repository.
+This is an independent open-source library in the broader Secure Tools ecosystem. Future integration will verify the release version, license, and SHA-256 checksum, then vendor the pinned browser artifact on the same origin rather than coupling application code to this repository.
 
 ## License
 

SECURITY.md

@@ -2,12 +2,12 @@
 
 ## Supported versions
 
-| Version | Support                            |
-| ------- | ---------------------------------- |
-| 0.1.x   | Supported after public publication |
-| < 0.1   | Not supported                      |
+| Version | Support                           |
+| ------- | --------------------------------- |
+| 0.1.x   | Supported through GitHub releases |
+| < 0.1   | Not supported                     |
 
-The current repository may contain an unpublished release candidate. A candidate is not a supported npm release until publication completes.
+`v0.1.0` is published as a GitHub release. The package is not published to npm.
 
 ## Reporting a vulnerability
 

docs/releasing.md

@@ -1,8 +1,8 @@
 # Release process
 
-This document defines the `v0.1.0` release-candidate process. It does not authorize publishing, tagging, or creating a GitHub release during development.
+This document defines release validation and publication. `v0.1.0` is published as an immutable GitHub release from commit `352258ec413a838dfe8b9146370505f125b5ae10`; it is not published to npm.
 
-## Candidate validation
+## Release validation
 
 Start from a clean commit on the intended release revision, with Node.js 24 and Chromium installed for Playwright. Run:
 
@@ -24,16 +24,16 @@ The browser artifact is a same-origin deployment asset, not a CDN dependency. Pi
 
 ## Licensing
 
-The published package has no runtime dependencies and the bundled JavaScript contains project source only. Dev tooling is audited by `npm run license:audit`; its accepted SPDX set is explicit in that script. No third-party NOTICE file is currently required. Re-run the audit and review bundled content whenever dependencies or build configuration change.
+The packaged library has no runtime dependencies and the bundled JavaScript contains project source only. Dev tooling is audited by `npm run license:audit`; its accepted SPDX set is explicit in that script. No third-party NOTICE file is currently required. Re-run the audit and review bundled content whenever dependencies or build configuration change.
 
 ## Trusted Publishing
 
-Before the first publication, an npm package owner must configure Trusted Publishing for this repository, the `publish.yml` workflow, and the `npm` GitHub environment. The workflow uses GitHub OIDC (`id-token: write`) and `npm publish --provenance`; it intentionally contains no long-lived npm token.
+No npm publication has been performed. Before any future npm publication, an npm package owner must configure Trusted Publishing for this repository, the `publish.yml` workflow, and the `npm` GitHub environment. The workflow uses GitHub OIDC (`id-token: write`) and `npm publish --provenance`; it intentionally contains no long-lived npm token.
 
-After merging an approved release commit:
+For a future release after merging an approved release commit:
 
 1. confirm all required checks pass on the exact commit;
-2. create the signed or annotated tag `v0.1.0` on that commit;
+2. create the signed or annotated version tag on that commit without moving an existing release tag;
 3. push the tag and review the publish workflow and npm provenance attestation;
 4. create GitHub release notes from `CHANGELOG.md` and attach the independently verified files from `release/` if desired;
 5. verify installation from npm and the same-origin browser artifact in a fresh consumer.