[AgenteLabs]

What changed

Part of the estate-wide npm scope reorganisation (@flashyfinancial and @flashynetwork already exist on npm):

• package.json: "@flashyos/ledger" → "@flashynetwork/ledger", "1.0.1" → "2.0.0". Nothing else (exports, files, engines, publishConfig) changed.
• .github/workflows/publish.yml: setup-node's scope → @flashynetwork; the token-refusal step and the publish step now read secrets.NPM_TOKEN_FLASHYNETWORK_CI || secrets.NPM_TOKEN (was secrets.NPM_TOKEN alone), with the error message updated to name the new secret and scope; added a Skip if this version is already published step (same shape as flashy-rails' publish.yml) so a re-run of the dispatch flow is idempotent against a version already on the registry instead of failing E409.
• .github/workflows/deprecate-old-scope.yml (new): workflow_dispatch-only, ported from flashy-rails' own workflow of the same name, with its actions pinned to the same commit SHAs publish.yml already uses (this repo's tests/workflow-pins.test.ts requires that). Runs npm deprecate @flashyos/ledger@* "moved to @flashynetwork/ledger" — never on push, pull_request or schedule.
• tests/package-scope.test.ts (new, vitest, matching this repo's existing tests/*.test.ts convention): sweeps package.json, package-lock.json (if present), README.md and every .github/workflows/*.yml file for leftover @flashyos/ledger text, excluding the files that legitimately still name it on purpose (the deprecate workflow, RELEASES.md, README.md's own history prose); asserts publish.yml names the new scope and not the old one; asserts the deprecate workflow exists, calls npm deprecate, triggers on workflow_dispatch only, and reuses the existing npm secret rather than inventing a new one.
• RELEASES.md: new 2.0.0 row (commit —, tagged ❌, publish pending), plus a short dated section explaining the jump from 1.0.1 straight to 2.0.0. No existing row altered.
• CHANGELOG.md: new ## [2.0.0] section — tests/docs-drift.test.ts requires one for package.json's declared version and for every version RELEASES.md records, so this was necessary for the suite to stay green, not just nice-to-have.
• README.md: title, the npm install line, the Using it import, the Status line and the whole Publishing section now name @flashynetwork/ledger and NPM_TOKEN_FLASHYNETWORK_CI; the @flashylabs → @flashyos history stays exactly as written, with the @flashyos → @flashynetwork move added on top of it rather than replacing it.
• tests/public-api.test.ts: one stale @flashyos/ledger string in an assertion-failure message, updated for consistency (cosmetic; not something package-scope.test.ts sweeps, since that sweep's file list matches what was asked for).

Why 2.0.0, not 1.0.2 or 1.1.0

flashy-rails's package.json already declares:

"dependencies": { "@flashynetwork/ledger": "^2.0.0" }

— and currently 404s installing it, because nothing has ever been published under that name or that major. A 1.0.2 release under the new scope would still leave flashy-rails's ^2.0.0 range unsatisfied; 2.0.0 is the version that actually closes the gap. The tree itself is unchanged from 1.0.1 — this is a scope/version rename, not an API change — which is why it's recorded as "BREAKING (scope rename, not an API change)" in the changelog rather than as a real semver-major break.

This is source-only

Nobody but the repository owner can run npm publish — that needs an npm access token with publish rights on @flashynetwork. Concretely, before anything resolves on the registry, a human needs to:

1. Set the NPM_TOKEN_FLASHYNETWORK_CI repository secret (or confirm NPM_TOKEN already has @flashynetwork publish rights).
2. Dispatch the Publish workflow (or push a v2.0.0 tag) from main after this merges.
3. Once that lands, dispatch Deprecate old npm scope by hand to point any stragglers on @flashyos/ledger at the new name.
4. Update RELEASES.md's 2.0.0 row (commit/tagged/publish landed) once the publish actually lands, per the existing "Adding a release" convention at the bottom of that file.

Until step 2 happens, @flashynetwork/ledger@2.0.0 will keep 404ing for flashy-rails exactly as it does today — this PR fixes the source of truth, not the registry.

Test plan

• tests/package-scope.test.ts (new): the sweep, the deprecate-workflow shape, the trigger restriction — all written to fail on the pre-rename tree and pass on this one.
• tests/workflow-pins.test.ts: re-read against the new deprecate-old-scope.yml — both uses: lines pinned to the same commit SHAs publish.yml uses, with version comments.
• tests/docs-drift.test.ts: CHANGELOG.md now has a ## [2.0.0] section matching package.json's version, and a section for every version RELEASES.md records (including the new row).
• tests/releases.test.ts: the new RELEASES.md row is in ascending order, appears once, and is the version package.json declares.
• tests/cross-linking.test.mjs, tests/public-api.test.ts, tests/charter-served.test.ts, the rest of the pre-existing suite: untouched in substance, should be unaffected by a name/version/workflow change.
• CI on this branch — watching now; will report back (or fix forward) once it's run.
• Owner: after merge, set NPM_TOKEN_FLASHYNETWORK_CI, dispatch Publish, confirm npm view @flashynetwork/ledger@2.0.0 resolves, then dispatch Deprecate old npm scope.

---

Generated by Claude Code

[AgenteLabs]

CI status on this branch (head cdd25dd):

• ✅ Typecheck, lint, test — success (typecheck, lint, the full coverage suite, the standalone node tests, build)
• ✅ Conformance against MongoDB — success
• ❌ Dependency audit (npm audit --audit-level=high) — pre-existing, unrelated to this PR.

The dependency-audit failure is 11 transitive devDependency advisories (vitest/@vitest/mocker, @typescript-eslint/typescript-estree's minimatch, and vite via the vitest toolchain) — nothing this PR touched (package.json's devDependencies are unchanged by this diff; only name and version moved). It fails identically on main at its current head (run 41663515966, job "Dependency audit", npm audit --audit-level=high → failure) and on every recent main run checked. Not something to fix in this PR — it's a devDependency-upgrade task orthogonal to the scope rename.

Everything else is green. Proceeding to merge.

---

Generated by Claude Code