[planadecu]

Brings the repository files in line with the Glassnode standard for public repos (GN-180). No change to the published package: no code, package.json or build change.

What changed

• CLAUDE.md → AGENTS.md. AGENTS.md now points to CONTRIBUTING.md and lists only the traps an agent would hit: hand-editing the contract fixtures, running the fixture recorder against the live API, bumping @types/node/TypeScript past the pins, extensionless or .ts imports in src/, adding a browser field, .transform() on GlassnodeConfigSchema, publishConfig.tag, exposing the API key, and renaming the required CI jobs or unpinning actions.
• CONTRIBUTING.md. Takes the CLAUDE.md content humans also need, in a new Design notes section: the two Node.js baselines, toolchain pins (@types/node, TypeScript 6.x, typedoc), TypeDoc rules, build targets and packaging decisions (no browser field, .js specifiers, plain z.object config schema), CI jobs and action pinning, and the publishing setup (Trusted Publishing, npm environment, dist-tag guard). Also:
  • Docs-, CI- and tooling-only changes no longer bump the version or add a CHANGELOG entry, matching the standard (the "Patch" line no longer lists docs).
  • The local check list adds the x402 node16 consumer type-check and the CHANGELOG heading check, which CI already runs.
  • A contract test that fails against a fixture is called out as API drift: fix the schema.
  • Security reports point to SECURITY.md.
  • The project layout mentions NOTICE shipping in the tarball. NOTICE itself is unchanged.
  • Content dropped as duplicate: the project layout, the command list, the semver policy, the release-branch flow and the API client config (README "Configuration", "Retries", "Observability" and "Browser" already cover it).
• SECURITY.md (new): private reporting through GitHub's "Report a vulnerability", with security@glassnode.com as fallback. No bug bounty; only the latest release gets fixes.
• .github/dependabot.yml (new): weekly npm updates for / (pnpm) and /examples (npm), with minor and patch grouped, and weekly grouped github-actions updates. A 7-day cooldown matches minimum-release-age in .npmrc. @types/node major updates are ignored because the floor pins it.
• .gitignore: adds .env.* (keeping examples/.env.example), *.local, *.pem and *.key.
• .npmignore: CLAUDE.md entry renamed to AGENTS.md.

Verification

• pnpm install --frozen-lockfile, pnpm run lint, pnpm test (696 passed), pnpm run docs, npx prettier --check .: all pass.
• node scripts/check-changelog-heading.mjs main passes: the top heading is still ## 1.0.0, equal to package.json, so CI doesn't need a version bump for this PR.
• dependabot.yml parses as YAML. Dependabot validates it on merge.

Downstream impact

• Nothing is published: the version stays 1.0.0, so the release workflow skips the release after merge.
• Dependabot starts opening weekly PRs: one grouped minor/patch PR per npm directory, one per major update, and one for Actions. Per the updated CONTRIBUTING rule, dev-dependency and Actions updates don't bump the version. Runtime dependency changes (zod, peer ranges) still do.

[rafalbromirski]

Minor: You can probably also add:

• CONTRIBUTING.md
• SECURITY.md
  ?

Not sure if this needs to be part of the package that you install because usually nobody is looking at node_modules and they refer to github repo