feat(repo)!: replace wrapper with native Hey API SDK - #3

Install the npm tarball in an isolated consumer before exercising generated GET, POST,
authentication, response, and error behavior against a deterministic local server.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Align local development, CI, and npm releases on the monorepo's pinned pnpm version. Replace the
Yarn lockfile, update package verification tools for pnpm's strict dependency graph, and avoid
tracing authentication tokens.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Use Release Please with a repository-scoped GitHub App token and connect it to the package release
workflow.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Declare the supported Node.js runtime and tree-shaking behavior, and omit repository-only scripts
from the distributed package manifest.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Explain the 0.2 client construction and operation shape, including the wrapper conveniences that
consumers must replace.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Build and run full package verification on Node.js 24, then install and execute the exact verified
tarball under Node.js 20 without the incompatible development toolchain.

Restrict workflow permissions and avoid duplicate pull-request runs.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Authenticate npm releases with short-lived GitHub OIDC credentials and provenance instead of a
long-lived registry token.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Replace the placeholder author and add canonical repository, issue tracker, and homepage links for
consumers and registry tooling.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Record the GitHub App permissions, repository secrets, and npm trusted publisher configuration
needed to operate releases.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Require GitHub Actions and an exact package-version tag before npm can receive a release.

Cover accepted and rejected refs in the package test suite.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Warn consumers to keep credentials in trusted server code.

Replace private repository links with public issue-reporting guidance.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Run npm version and trusted-publisher metadata checks in the actual publish path.

Do not rely only on Release Doctor.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Generate from a reviewed OpenAPI snapshot instead of the moving production URL. Provide an
explicit sync command, preserve the inferred API origin, and fail verification when checked-in
generated source has drifted.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Share Node.js 24 package verification between CI and releases, run the exact packed tarball under
Node.js 20, and publish that same archive only after both gates pass. Limit OIDC permission to the
final publishing job and reject archives whose package identity differs from the release checkout.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Keep high-level resource operations on a data-or-throw contract so HTTP,
transport, abort, URL, and parsing failures cannot become ambiguous undefined
results. Leave advanced response handling available through the native low-level
Hey client.

Default the exported client factory to the production API URL and throwing
behavior while retaining explicit low-level overrides.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Allow publishing only when npm returns a valid previous version or an explicit
E404 for an unpublished package. Reject registry failures and empty or malformed
responses before choosing a distribution tag or invoking npm publish.

Exercise the complete publisher with a fake npm executable so accepted and
rejected registry outcomes remain covered.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Remove Git URL installation guidance because generated build output is not
committed and those installs cannot satisfy the package export map. Direct
contributors to the packed dist artifact that matches npm releases.

Clarify the explicit-client requirement and the migration away from Git
dependencies.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Identify the existing undocumented GET stub explicitly while making generation
fail for any new operation without a tag or operation ID. This prevents an API
surface regression from silently removing SDK methods.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Exercise getTemplate through the packed consumer and assert that reserved path
characters are encoded while authentication and response parsing still work.
This completes runtime coverage of path, query, and JSON-body inputs.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Use the repository-scoped GITHUB_TOKEN for Release Please.

Explicitly dispatch CI and tag-based npm publishing because token-created events do not recurse.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Explain the daily production sync, repository-scoped release credentials, and trusted npm publishing flow.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Have GitHub sign the automation branch commits so generated update PRs retain verifiable provenance.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Remove Hey API's generated registry and singleton fallback through the fail-closed postprocessor. Require an explicit client and verify the public type and packed runtime surfaces do not expose global client state.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Force the generator dependency graph onto the patched js-yaml release so development and synchronization audits are clean.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>

Pin the write-capable create-pull-request action to the immutable v8.1.1 commit.

Co-Authored-By: Codex (gpt-5.6-sol xhigh) <codex@openai.com>