dsh-loci 2.0.0 → 2.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +18 -0
- package/client.js +1367 -1367
- package/docs/ACCEPTANCE.md +279 -279
- package/docs/PRIVACY.md +93 -93
- package/package.json +1 -1
- package/src/host/index.js +290 -290
- package/src/host/store/audit.js +208 -208
- package/src/host/store/store.js +1538 -1538
- package/src/mcp/store-facade.js +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,24 @@ All notable changes to this project are documented here. The format follows
|
|
|
4
4
|
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the project follows
|
|
5
5
|
[Semantic Versioning](https://semver.org/spec/v2.0.0.html) from 1.0.0.
|
|
6
6
|
|
|
7
|
+
## [2.0.1] — 2026-11-14
|
|
8
|
+
|
|
9
|
+
### Changed
|
|
10
|
+
|
|
11
|
+
- **Publishing now uses Trusted Publishing (OIDC) only.** `setup-node` no longer
|
|
12
|
+
receives `registry-url` and the publish step no longer reads `NODE_AUTH_TOKEN`:
|
|
13
|
+
the collaboration center's npm runbook records both as `ENEEDAUTH` traps, and
|
|
14
|
+
with a Trusted Publisher bound, the OIDC identity token is the credential. The
|
|
15
|
+
repository therefore holds no npm secret.
|
|
16
|
+
- `release.yml` gained an `npm >= 11.5` check, because npm 10 never performs the
|
|
17
|
+
OIDC exchange.
|
|
18
|
+
|
|
19
|
+
### Note
|
|
20
|
+
|
|
21
|
+
`2.0.0` was the bootstrap publish (npm does not allow a first publish over OIDC,
|
|
22
|
+
[npm/cli#8544](https://github.com/npm/cli/issues/8544)), so it carries no
|
|
23
|
+
attestation. **2.0.1 is the first version with a provenance attestation.**
|
|
24
|
+
|
|
7
25
|
## [2.0.0] — 2026-11-14
|
|
8
26
|
|
|
9
27
|
### Added
|