@kaminari-ad/mcp 0.1.0 → 0.1.5

package/CHANGELOG.md

@@ -7,6 +7,96 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.5] - 2026-05-17
+
+Re-release of v0.1.4 — the Corepack-based npm upgrade in v0.1.4
+reported `Preparing npm@^11 for immediate activation...` but the
+shell still showed bundled `npm 10.9.7`, because Corepack shims
+were not in PATH priority. Publish failed at the same point (404).
+
+### Fixed
+
+- **Release workflow pinned to Node 24** (instead of .nvmrc Node 22)
+  so the bundled npm is 11.x, which has built-in Trusted Publisher
+  OIDC publish support. CI and local dev keep .nvmrc Node 22 — only
+  the release job overrides. Added an explicit `npm --version` gate
+  that fails the build if npm < 11.5.1 (defense against future Node
+  releases bundling older npm).
+
+## [0.1.4] - 2026-05-17
+
+Re-release of v0.1.3 — that release's `npm install -g npm@^11`
+step broke mid-upgrade with `Cannot find module 'promise-retry'`
+(npm 10 → 11 in-place self-upgrade leaves a broken state because
+newer arborist references modules the old bundled tree never had).
+
+### Fixed
+
+- **Upgrade npm via Corepack instead of in-place self-upgrade.**
+  Corepack (bundled with Node 22+) manages the npm install via a
+  separate symlink layer and avoids the self-upgrade race. The
+  publish step now reliably runs against npm 11.x with full OIDC
+  Trusted Publisher support.
+
+## [0.1.3] - 2026-05-17
+
+Re-release of 0.1.1 / 0.1.2 (both failed at the npm publish step).
+The 0.1.2 OIDC debug step revealed every JWT claim matches the
+Trusted Publisher config perfectly — the failure was elsewhere.
+
+### Fixed
+
+- **npm CLI version too old for OIDC publishing.** GitHub Actions
+  Node 22 LTS runner ships with **npm 10.x bundled**, but npm
+  Trusted Publisher OIDC publish was introduced in **npm 11.5.1**
+  (Aug 2025). Without it, `npm publish --provenance` signs the
+  sigstore attestation BUT sends the actual PUT to the registry
+  unauthenticated → npm replies HTTP 404 "not found" (security
+  obscurity for "no auth"). Workflow now runs
+  `npm install -g npm@^11` before `npm ci` / publish, pinning the
+  latest npm 11.x line.
+
+## [0.1.2] - 2026-05-17
+
+Re-release of v0.1.1 — that tag's release pipeline failed at the
+npm publish step (HTTP 404 — npm Trusted Publisher OIDC subject
+mismatch we couldn't pre-diagnose). No 0.1.1 tarball ever landed
+on the registry; users skip straight from 0.1.0 to 0.1.2. Bin
+alias fix and OIDC switch from 0.1.1 carry forward; this release
+adds a diagnostic step that prints the GitHub OIDC subject claim
+before the publish attempt, so any future Trusted Publisher
+mismatch is visible in workflow logs (not silently 404'd).
+
+### Added
+
+- `release.yml` "Debug OIDC subject claim" step — fetches the
+  `npm:registry.npmjs.org`-audience OIDC token, decodes the JWT
+  payload, prints the `sub` / `repository` / `workflow` /
+  `environment` claims. Sensitive data is the signed token itself
+  (logged claims are public metadata).
+
+## [0.1.1] - 2026-05-17
+
+### Fixed
+
+- **`npx -y @kaminari-ad/mcp` failed with `command not found`.** npx
+  defaults the bin name to the **basename of the package** (`mcp` for
+  a scoped `@kaminari-ad/mcp`), but v0.1.0 declared bin
+  `kaminari-ad-mcp` only — so the documented Cursor / Claude Desktop
+  config in README literally did not start the server. Added `"mcp":
+  "./dist/bin.js"` as a second bin entry; both names now work
+  (`npx -y @kaminari-ad/mcp` and `npx -y -p @kaminari-ad/mcp
+  kaminari-ad-mcp`). No other changes — pure ergonomics.
+
+### Changed
+
+- **npm publish now uses GitHub Actions OIDC + provenance** instead
+  of a static `NPM_TOKEN`. Restored `publishConfig.provenance: true`
+  and `--provenance` flag in `release.yml`; the `npm-publish`
+  GitHub Environment + the Trusted Publisher registered on the npm
+  package settings page produce signed sigstore attestations
+  reachable from the npm package page.
+
 ## [0.1.0] - 2026-05-17
 
 First public release of `@kaminari-ad/mcp`.
@@ -379,5 +469,10 @@ Initial public release. The first version that ships to npm under
   need them.
 - Invoice PDF fetcher — same reason.
 
-[Unreleased]: https://github.com/kaminari-ad/mcp/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/kaminari-ad/mcp/compare/v0.1.5...HEAD
+[0.1.5]: https://github.com/kaminari-ad/mcp/compare/v0.1.0...v0.1.5
+[0.1.4]: https://github.com/kaminari-ad/mcp/compare/v0.1.0...v0.1.4
+[0.1.3]: https://github.com/kaminari-ad/mcp/compare/v0.1.0...v0.1.3
+[0.1.2]: https://github.com/kaminari-ad/mcp/compare/v0.1.0...v0.1.2
+[0.1.1]: https://github.com/kaminari-ad/mcp/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/kaminari-ad/mcp/releases/tag/v0.1.0

package/dist/bin.js

@@ -31,7 +31,7 @@ var NAME, VERSION;
 var init_version = __esm({
   "src/shared/version.ts"() {
     NAME = "@kaminari-ad/mcp";
-    VERSION = "0.1.0";
+    VERSION = "0.1.5";
   }
 });
 var REDACTED, BEARER_HASH_PREFIX_LEN, MAX_HEADER_LEN, BearerToken;