[jddunn]

fix: publish with a provenance attestation

The published version carries a provenance attestation, whether npm publishes it through trusted publishing or through the token. The version goes from 0.6.9 to 0.6.10, so the release workflow publishes it.

Kept as a draft until npm trusted publishing is configured for this package. Merging publishes a new version, which will be the first one published through the trusted publisher; it is marked ready and merged within two days of that.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[jddunn]

Closing as superseded. Every publish now carries a provenance statement: the release workflow publishes with --provenance through the trusted publisher since #79, and 0.8.3 went out that way (release run 40228394330 logged "Signed provenance statement with source and build information from GitHub Actions"). The version raise to 0.6.10 is obsolete, since npm holds 0.8.3, and the release no longer needs a raised version to publish. Nothing else is on this branch.