dcr-ts 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -4,6 +4,44 @@ Notable changes per release. Dates are release dates.
 
 This library has **not** been independently audited. See [SECURITY.md](SECURITY.md).
 
+## 0.2.1 — 2026-08-25
+
+**No changes to the library.** `src/` is byte-identical to 0.2.0 and the built
+bundle is unchanged; the package version is not embedded in it. Everything here
+is release infrastructure, plus the one thing that could only be tested by
+performing a release.
+
+### Changed — releasing
+
+- **Publishing moved to CI, authorised by a signed tag.** The workflow verifies
+  the tag against an allowed-signers list before it does anything else, pins the
+  checkout to the commit the tag points at, refuses a tag that disagrees with
+  `package.json`, and re-runs the full gates — typecheck, tests, both-format
+  entry-point resolution, a production-dependency audit, and a dcrd vector
+  regeneration — before it can publish.
+- **Authentication is OIDC, not a stored token.** Trusted publishing means no
+  long-lived credential exists in the repository at all, and npm generates the
+  provenance attestation automatically. 0.2.0 was published by hand before the
+  package existed on the registry, so it carries no attestation; this is the
+  first release that does.
+- **The signer policy is read from the default branch, not from the tag.**
+  Reading it from the tagged tree would have let a tag supply the policy
+  authorising it — a tag carrying its own allowed-signers list, signed with the
+  key it names, would have verified itself.
+- **Canonical `repository.url`** (`git+https://…​.git`), matching what
+  `hosted-git-info` normalises to. This was previously described as a provenance
+  fix; it is not. `libnpmpublish` never reads the field when generating an
+  attestation.
+- **CI and npm badges in the README**, which is also the package page on npm.
+
+### Why this version exists
+
+The publish step had never executed. The republish guard correctly stops any
+re-run against a version already on the registry, so no amount of re-running
+0.2.0 could exercise the OIDC exchange — only a version that does not yet exist
+can. Releasing 0.2.1 is how the path gets proven, and the cost is a version
+number rather than an untested release pipeline discovered at the worst moment.
+
 ## 0.2.0 — 2026-08-25
 
 ### Fixed — consensus

package/README.md

@@ -1,5 +1,8 @@
 # dcr-ts
 
+[![CI](https://github.com/jzbz/dcr-ts/actions/workflows/ci.yml/badge.svg)](https://github.com/jzbz/dcr-ts/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/dcr-ts)](https://www.npmjs.com/package/dcr-ts)
+
 Decred (DCR) primitives for TypeScript: **BLAKE-256**, addresses, WIF, **BIP32
 HD keys** with Decred serialization, BIP39 mnemonics, the **transaction wire
 format**, the **Decred signature hash**, and **low-S ECDSA** P2PKH signing.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "dcr-ts",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Decred (DCR) primitives for TypeScript: BLAKE-256, addresses, BIP32 HD keys, WIF, the transaction wire format, the Decred signature hash, and low-S ECDSA signing. Byte-exact with dcrd.",
   "type": "module",
   "license": "ISC",
   "author": "Jonathan Zeppettini <jz@jz.bz>",
   "repository": {
     "type": "git",
-    "url": "https://github.com/jzbz/dcr-ts"
+    "url": "git+https://github.com/jzbz/dcr-ts.git"
   },
   "keywords": [
     "decred",