Added npm published event and doc fixes

Author: wolpert

CHANGELOG.md

@@ -64,6 +64,17 @@ Security-review follow-ups (hardening; no known exploit in the items below).
   handle a `null` jti, and that the Spring JWT filter is additive (never
   clears a pre-existing `SecurityContext`).
 
+### Distribution
+
+- **The browser SDK is now published to npm as
+  [`@pk-auth/passkeys-browser`](https://www.npmjs.com/package/@pk-auth/passkeys-browser)
+  at `1.3.0`** — its first npm release. The SDK version tracks the pk-auth
+  server release it speaks to, so `1.3.0` matches this release's Maven
+  Central artifacts. Install with `npm install @pk-auth/passkeys-browser`.
+  See [`RELEASE.md`](./RELEASE.md) for the publish steps. (The example
+  apps still consume the SDK via a relative `dist/` import built by
+  Gradle, not the published package.)
+
 ## [1.2.0] — 2026-06-02
 
 ### Security

DESIGN.md

@@ -120,7 +120,7 @@ modules implement SPIs declared in core and are wired in by the host.
 | `pk-auth-spring-boot-starter` | Spring Boot 4 / Spring Security 7 autoconfigure + controller. |
 | `pk-auth-dropwizard` | Dropwizard 5 `ConfiguredBundle` + Dagger 2 wiring + Jersey resources. |
 | `pk-auth-micronaut` | Micronaut 4 controllers + `@Filter` JWT validation (no Micronaut Security). |
-| `clients/passkeys-browser` | TypeScript SDK. ESM + CJS, zero deps, vitest-tested. |
+| `clients/passkeys-browser` | TypeScript SDK (npm: `@pk-auth/passkeys-browser`). ESM + CJS, zero deps, vitest-tested. |
 | `examples/{spring-boot,dropwizard,micronaut}-demo` | Runnable demos with the shared SPA. |
 
 ## 4. The wire contract
@@ -340,7 +340,10 @@ SPIs.
 ## 9. The TS SDK
 
 `clients/passkeys-browser/` is a zero-dep TypeScript SDK that ships
-both ESM and CJS bundles. Two clients:
+both ESM and CJS bundles, published on npm as
+[`@pk-auth/passkeys-browser`](https://www.npmjs.com/package/@pk-auth/passkeys-browser)
+(`npm install @pk-auth/passkeys-browser`; its version tracks the pk-auth
+server release it speaks to). Two clients:
 
 - **`PkAuthCeremonyClient`** — full `register()` and `authenticate()`
   flows that wrap `navigator.credentials.{create,get}`, handling all

GETTING_STARTED.md

@@ -117,6 +117,12 @@ Skip them and the feature isn't exposed.
 |---|---|---|
 | `clients/passkeys-browser` (`@pk-auth/passkeys-browser`) | Zero-dependency TypeScript SDK. `PkAuthCeremonyClient` wraps `navigator.credentials.{create,get}` and handles all the base64url ↔ ArrayBuffer conversions. `PkAuthAdminClient` calls the admin endpoints with a bearer token. ESM + CJS bundles. | If your frontend talks to pk-auth from a browser. Skip if you're calling the JSON endpoints from a non-browser client (mobile, server-to-server). |
 
+The SDK is on npm — its version tracks the pk-auth release it speaks to:
+
+```sh
+npm install @pk-auth/passkeys-browser
+```
+
 ## 3. What you have to do (the SPI surface)
 
 pk-auth's design assumes **your app already has a user table**. It doesn't

README.md

@@ -52,7 +52,9 @@ What you get out of the box:
 - Persistence options: in-memory (testkit), JDBI + Postgres with Flyway
   migrations, or DynamoDB single-table.
 - A zero-dependency browser SDK (`@pk-auth/passkeys-browser`) covering
-  both ceremony and admin operations.
+  both ceremony and admin operations, published on npm
+  (`npm install @pk-auth/passkeys-browser`). Its version tracks the
+  pk-auth server release it speaks to.
 
 ```mermaid
 flowchart LR

SECURITY.md

@@ -0,0 +1,71 @@
+# Security Policy
+
+pk-auth is an authentication library, so security reports are taken seriously
+and handled with priority. Thank you for helping keep it and its users safe.
+
+## Supported versions
+
+Fixes land on the latest published `1.x` line. Maven Central and npm releases
+are immutable, so a security fix ships as a new patch (or minor) release rather
+than a re-publish of an affected version — upgrade to the latest release to pick
+it up.
+
+| Version            | Supported          |
+| ------------------ | ------------------ |
+| Latest `1.x` release | :white_check_mark: |
+| Older `1.x` releases | Fix only via the next release |
+| `0.x` (pre-stable) | :x:                |
+
+The browser SDK (`@pk-auth/passkeys-browser`) shares the same version line as
+the JVM artifacts and follows the same support window.
+
+## Reporting a vulnerability
+
+**Please do not open a public issue, pull request, or discussion for a
+suspected vulnerability.** Public disclosure before a fix is available puts
+downstream users at risk.
+
+Use one of these private channels instead:
+
+1. **GitHub private vulnerability reporting (preferred).** On the repository,
+   go to the **Security** tab → **Report a vulnerability**, or open
+   <https://github.com/codeheadsystems/pk-auth/security/advisories/new>. This
+   creates a private advisory thread visible only to you and the maintainers.
+2. **Email.** Send details to **ned.wolpert@gmail.com** with `pk-auth security`
+   in the subject line.
+
+Please include, as far as you can:
+
+- The affected module(s) and version (e.g. `pk-auth-core 1.3.0`).
+- A description of the issue and its impact (what an attacker can do).
+- Steps to reproduce — a minimal proof of concept, failing test, or request
+  sequence is ideal.
+- Any relevant configuration (adapter, persistence backend, SPI implementations).
+
+## What to expect
+
+- **Acknowledgement** within **3 business days**.
+- An initial assessment (severity, affected versions, whether it reproduces)
+  within **10 business days**.
+- We aim to ship a fix within **90 days** of triage and will keep you updated on
+  progress. Complex issues may take longer; we will say so.
+- We follow **coordinated disclosure**: we ask that you keep the report private
+  until a fix is released and a GitHub Security Advisory is published. We are
+  happy to credit you in the advisory unless you prefer to remain anonymous.
+
+## Scope
+
+This policy covers the pk-auth library, its three host adapters
+(`pk-auth-spring-boot-starter`, `pk-auth-dropwizard`, `pk-auth-micronaut`), the
+wire contract, and the browser SDK in this repository.
+
+It does **not** cover the responsibilities a host application retains — TLS,
+network ingress, secrets management, and the authorization layer above
+authentication. See [`docs/threat-model.md`](docs/threat-model.md) for the
+trust boundaries and STRIDE analysis, and [`docs/stability.md`](docs/stability.md)
+for the SPI versioning and stability guarantees.
+
+> **Maturity note.** As stated in the repository README, this project's code is
+> AI-generated and has not undergone a formal third-party security review unless
+> a note in the repository says otherwise. Evaluate it accordingly before
+> production use.

site/index.html

@@ -1567,10 +1567,10 @@ <h4>Admin &amp; SDK</h4>
               </div>
               <div class="module-card">
                 <div class="module-card-top">
-                  <span class="module-card-name"><b>npm:</b>@pk-auth/passkeys-browser</span>
+                  <span class="module-card-name"><b>npm:</b><a href="https://www.npmjs.com/package/@pk-auth/passkeys-browser">@pk-auth/passkeys-browser</a></span>
                   <span class="tag">TypeScript</span>
                 </div>
-                <p>Zero-dependency ceremony + admin clients. ESM and CJS bundles. Handles all <code>ArrayBuffer</code> &harr; <code>base64url</code> wrangling around <code>navigator.credentials</code>. The refresh client returns a typed result sum &mdash; it never throws on 401.</p>
+                <p>Zero-dependency ceremony + admin clients, on npm (<code>npm install @pk-auth/passkeys-browser</code>) &mdash; its version tracks the server release. ESM and CJS bundles. Handles all <code>ArrayBuffer</code> &harr; <code>base64url</code> wrangling around <code>navigator.credentials</code>. The refresh client returns a typed result sum &mdash; it never throws on 401.</p>
               </div>
             </div>
           </div>
@@ -1780,6 +1780,7 @@ <h4>Project</h4>
             <li><a href="https://github.com/codeheadsystems/pk-auth">Source on GitHub</a></li>
             <li><a href="https://github.com/codeheadsystems/pk-auth/issues">Issues</a></li>
             <li><a href="https://central.sonatype.com/search?q=g:com.codeheadsystems">Maven Central</a></li>
+            <li><a href="https://www.npmjs.com/package/@pk-auth/passkeys-browser">Browser SDK on npm</a></li>
             <li><a href="https://github.com/codeheadsystems/pk-auth/blob/main/CONTRIBUTING.md">Contributing</a></li>
           </ul>
         </div>