@zixcel/projection-contracts 0.10.0 → 0.10.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -39,3 +39,7 @@ disposable fence: it does not promise durability across restart. Use
|
|
|
39
39
|
Run the repository workspace install, type checks and behavioral tests described
|
|
40
40
|
in the root README. Public dependencies resolve from npm; no vendor archive or
|
|
41
41
|
private registry is required. [License](LICENSE) · [Notices](NOTICE).
|
|
42
|
+
|
|
43
|
+
## Release provenance
|
|
44
|
+
|
|
45
|
+
Starting with 0.10.1, releases use GitHub Actions OIDC trusted publishing from `zixcel/projection-runtime` (`publish-npm.yml`), without a stored npm publishing token. The workflow verifies reviewed archive hashes and requires npm provenance metadata. Check the published version on npm and verify registry signatures and provenance with `npm audit signatures` in an installed consumer project. Package runtime behavior and API contracts are unchanged by this release.
|