Published package metadata cannot be changed without shipping another
version, so this has to land before 0.1.0 goes out, not after.
- repository/homepage/bugs were all missing: the npm page would have
rendered with no link back to the source at all. repository names the
GitHub mirror deliberately — npm tooling and the --provenance
attestation are keyed to the repo the workflow builds in; the canonical
repository is stated in the README instead.
- README is the npm page body. Its Quick Start opened with `cd
mcp-server && npm install`, which is the from-a-clone path — the one
instruction that cannot work for somebody who just installed the
package. `npx fleet-memory-mcp` first, clone path kept below it, and a
line saying this package is the client half and does not start a store.
- LICENSE was not in the tarball. MIT text now ships with the artifact,
Vectorize AI copyright intact.
- engines and an explicit files list, so the tarball contents are stated
rather than inferred.
