docs: drop the 1.0 wording and the release workflow for now (#434)

The version stays 0.0.7 until a release is planned. The changelog
section is now Unreleased, the docs and comments say "after 0.0.7"
instead of naming 1.0, the tools page heading is "Renamed tools", and
SECURITY.md is back to its early-development wording. The tag-driven
release workflow and its notes script are removed until publishing is
set up again.

Author: erkamyaman

.github/workflows/e2e.yml

@@ -2,8 +2,8 @@ name: E2E
 
 # The slow end-to-end checks that do not fit a pull request: every panel view in a real browser,
 # multi-tab and lifecycle resilience, and the install matrix from a packed tarball. Pull requests
-# run the security and MCP checks (ci.yml), and the release runs a slice of the install matrix on
-# the tarball it publishes (release.yml). See apps/docs/src/content/contributing/development.md.
+# run the security and MCP checks (ci.yml), and a release can run a slice of the install matrix on
+# its tarball. See apps/docs/src/content/contributing/development.md.
 on:
   schedule:
     # Mondays at 07:00 UTC, an hour after latest.yml and compat.yml.

.github/workflows/release.yml

@@ -2,14 +2,8 @@
 
 ## Supported versions
 
-Security fixes go to the 1.x release line of `@pangular-inspector/devtools`, in its latest
-minor release. Versions before 1.0 are not supported: upgrade to the latest 1.x release to get a
-fix.
-
-| Version | Supported |
-| ------- | --------- |
-| 1.x     | Yes       |
-| < 1.0   | No        |
+Pangular Inspector is in early development. Only the latest published release of
+`@pangular-inspector/devtools` is supported. There are no older release lines to backport a fix to.
 
 ## Reporting a vulnerability
 

SECURITY.md

@@ -1013,9 +1013,9 @@ A server plugin adds tools named `plugin:<plugin id>:<tool>`, which your client
 
 Use it for data that has no dedicated tool, such as hydration data and TransferState payloads (`pangular:http`, `pangular:http-payloads`) or live pipe usage (`pangular:pipe-usage`). See [Resources](./resources.md) for every key.
 
-## Names before 1.0
+## Renamed tools
 
-Version 1.0 renamed tools and arguments so that each name follows one pattern: an optional library prefix (`ngrx-`, `redux-`, `tanstack-`, `capacitor-`, `analog-`), then a verb that says whether the tool reads source (`scan`), reads the page (`list`, `inspect`, `explain`, `lint`) or writes (`run`, `set`, `record`). The old names are not accepted.
+Tools and arguments were renamed after 0.0.7 so that each name follows one pattern: an optional library prefix (`ngrx-`, `redux-`, `tanstack-`, `capacitor-`, `analog-`), then a verb that says whether the tool reads source (`scan`), reads the page (`list`, `inspect`, `explain`, `lint`) or writes (`run`, `set`, `record`). The old names are not accepted.
 
 | Before                                                                                   | Now                                                                                                             |
 | ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |

apps/docs/src/content/agents/tools.md

@@ -90,46 +90,11 @@ This runs `pnpm --filter @pangular-inspector/devtools publish --access public`.
   <code>pnpm publish</code> checks git before it publishes. Run it from a clean working tree on <code>main</code>.
 </ngmd-alert>
 
-## Releasing
-
-Releases publish from CI, not from a laptop. `.github/workflows/release.yml` publishes the npm package with [provenance](https://docs.npmjs.com/generating-provenance-statements), so npm shows which commit and workflow built it.
-
-<ngmd-workflow>
-  <ngmd-step title="Bump the version and write the changelog">
-    In one pull request, set <code>version</code> in <code>packages/devtools/package.json</code> and add a <code>## 1.2.3</code> section to <code>packages/devtools/CHANGELOG.md</code>. List every removed or renamed export, option and tool under Upgrade notes. Merge it to <code>main</code>.
-  </ngmd-step>
-  <ngmd-step title="Tag the merged commit">
-    Wait for CI to pass on that commit of <code>main</code>. Then run <code>git tag v1.2.3</code> on it and <code>git push origin v1.2.3</code>. The tag starts the workflow. To rerun a release, start <strong>Release</strong> from the <strong>Actions</strong> tab and pick the tag, not a branch, under <strong>Use workflow from</strong>.
-  </ngmd-step>
-  <ngmd-step title="Approve the npm environment">
-    The job runs in the <code>npm</code> environment, which holds the <code>NPM_TOKEN</code> secret. Approve it when the run asks.
-  </ngmd-step>
-</ngmd-workflow>
-
-The workflow stops at the first check that fails, before anything reaches npm:
-
-1. The run is for a tag, and the tag is on `main`. The CI workflow (`ci.yml`) has a successful run on `main` for the tagged commit. The tag equals `v` plus the package version. The changelog has a non-empty section for that version (`scripts/release-notes.mjs`).
-2. `pnpm typecheck`, `pnpm test:devtools` and `pnpm test:panel` pass.
-3. `pnpm --filter @pangular-inspector/devtools pack` builds one tarball. The root `.pnpmfile.cjs` drops `devDependencies`, `scripts` and the `nx` block from the packed `package.json`.
-4. `pnpm verify:publish` (Angular CLI and Analog) and a few cells of `pnpm e2e:install` install that exact tarball from a local registry into fresh apps, open them in Chromium and run the package audit.
-5. `npm publish <tarball> --provenance --access public` publishes the same file. A version with a prerelease part, such as `1.3.0-rc.1`, goes to the `next` dist-tag; any other goes to `latest`.
-6. `gh release create` makes the GitHub release, with the changelog section as its notes and the tarball attached.
-
-The run keeps the tarball and the install reports as an artifact. To check a release candidate before you tag it, run the same steps locally:
-
-```bash
-pnpm --filter @pangular-inspector/devtools pack --pack-destination dist/release
-pnpm verify:publish --tarball=dist/release/pangular-inspector-devtools-1.2.3.tgz
-pnpm e2e:install --tarball=dist/release/pangular-inspector-devtools-1.2.3.tgz --cells=angular-cli:npm:22
-```
-
-`pnpm e2e:install` deletes its work folder when it ends, as it can reach several gigabytes. A failed run copies the logs out first and prints where they are. Pass `--keep` to keep the whole folder.
-
-### The public API
+## The public API
 
 Each entry point exports only what these docs describe, and only that is covered by semver. The files in `packages/devtools/src/entries` choose those exports, and `public-api.test.ts` lists them, so a new export is a deliberate change. Code shared between the server, the overlay and the panel, such as most of `config.ts`, stays internal: the panel imports it as `@pangular-inspector/devtools/internal/config`, a workspace-only export that `publishConfig.exports` leaves out. Mark a declaration that has to be exported for the package's own modules with `@internal`, and the published types leave it out.
 
-### Supported versions
+## Supported versions
 
 The Angular peer range has an upper bound, `>=12.2.0 <23.0.0`, because the overlay reads Angular's private debug APIs. Raise it in the release after the new major passes the [compatibility jobs](./development.md#angular-compatibility), and update the tested versions in [Installation](../getting-started/installation.md#tested-versions). `engines.node` is `>=22.12.0`, the first Node.js 22 that can `require()` the ES modules the Express hub loads.
 

apps/docs/src/content/contributing/publishing.md

@@ -94,7 +94,7 @@ A refused code is never compared with the real one. devframe gives you a new cod
 
 A browser that exchanges the code gets a session token, so it doesn't need the code again after a reload. The server keeps those tokens in `~/.pangular-inspector/auth/<project>/auth.json`, one folder per project (named after a hash of its path), so a token from one project doesn't open another project's server. The folder is readable by you only (mode `0700`), and the file too (`0600`). A token expires 7 days after the code was exchanged. To sign out every browser, delete the project's folder, or all of `~/.pangular-inspector/auth`, and restart the server.
 
-Versions before 1.0 kept the tokens in `~/.devframes/devframe/auth.json` (the Express hub and the Vite plugin) or `~/.pangular/devframe/auth.json` (the CLI), readable by other users and without expiry. Pangular Inspector 1.0 doesn't read those files. Delete them if no other devframe tool uses them.
+Version 0.0.7 and earlier kept the tokens in `~/.devframes/devframe/auth.json` (the Express hub and the Vite plugin) or `~/.pangular/devframe/auth.json` (the CLI), readable by other users and without expiry. Newer versions don't read those files. Delete them if no other devframe tool uses them.
 
 ### Express hub