@fidacy/mcp 0.2.8 → 0.2.9

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.2.9
+
+### Patch Changes
+
+- 1a3f504: Name the publisher in package metadata, and release through CI so the artifact
+  carries Sigstore provenance.
+
+  The `author` field was missing, which is why trust registries listed the packages
+  as authored by "Unknown". More importantly, every release so far went out as a
+  manual `npm publish` from a laptop, so no `@fidacy/*` package carried a
+  provenance attestation. Provenance is an OIDC statement from a CI runner about
+  which workflow built the artifact, so a laptop cannot produce one regardless of
+  flags. The Release workflow was already configured for it and simply had never
+  been used.
+
+  For a project whose entire claim is independently verifiable evidence, shipping
+  without supply-chain attestation was the wrong asymmetry.
+
 ## 0.2.5
 
 TypeScript declarations ship in the package. Every entrypoint (., ./assess,

package/dist/core.js

@@ -461,7 +461,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.2.8" : "dev";
+var CLIENT_VERSION = true ? "0.2.9" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";

package/dist/index.js

@@ -490,7 +490,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.2.8" : "dev";
+var CLIENT_VERSION = true ? "0.2.9" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -834,7 +834,7 @@ async function findArtifacts(sha2562, cfg) {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.2.8" : "dev";
+var CLIENT_VERSION2 = true ? "0.2.9" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -1264,7 +1264,7 @@ function renderAlertLine(alerts) {
 var state = ensureState();
 var core = makeCore();
 var subject = process.env.FIDACY_SUBJECT ?? "agent:demo";
-var SERVER_VERSION = true ? "0.2.8" : "dev";
+var SERVER_VERSION = true ? "0.2.9" : "dev";
 var bootClaim = claimUrl();
 var server = new McpServer(
   { name: "fidacy", version: SERVER_VERSION },

package/dist/lib.js

@@ -613,7 +613,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.2.8" : "dev";
+var CLIENT_VERSION = true ? "0.2.9" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -791,7 +791,7 @@ function requestUpgrade() {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.2.8" : "dev";
+var CLIENT_VERSION2 = true ? "0.2.9" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@fidacy/mcp",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "Fidacy action firewall for AI agents. Mandate-gated payment authorization as an MCP server.",
   "license": "Apache-2.0",
+  "author": "Fidacy (ZeepCode Group Technology LLC) <hello@fidacy.com> (https://fidacy.com)",
   "homepage": "https://fidacy.com",
   "keywords": [
     "mcp",
@@ -49,12 +50,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "node scripts/bundle.mjs",
-    "dev": "tsx watch src/index.ts",
-    "start": "node dist/index.js",
-    "prepublishOnly": "npm run build"
-  },
   "engines": {
     "node": ">=18"
   },
@@ -63,14 +58,19 @@
     "zod": "^3.25.0"
   },
   "devDependencies": {
-    "@fidacy/firewall": "workspace:*",
     "@types/node": "^22.10.0",
     "tsx": "^4.19.2",
-    "typescript": "^5.7.2"
+    "typescript": "^5.7.2",
+    "@fidacy/firewall": "0.1.1"
   },
   "mcpName": "com.fidacy/mcp",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/lucaslubi/fidacy-mcp.git"
+  },
+  "scripts": {
+    "build": "node scripts/bundle.mjs",
+    "dev": "tsx watch src/index.ts",
+    "start": "node dist/index.js"
   }
-}
+}