llmnav 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -6,6 +6,14 @@ The npm package follows Semantic Versioning. The `llmnav/N` source protocol is v
 
 ## [Unreleased]
 
+## [0.5.2] — 2026-08-09
+
+### Fixed
+
+* Made tag publication idempotent only when the existing npm tarball integrity matches the tagged package.
+* Kept Trusted Publisher OIDC releases compatible with a private source repository by disabling unsupported provenance generation.
+* Aligned the package author and MIT copyright holder with the public `0disoft` identity.
+
 ## [0.5.1] — 2026-08-09
 
 ### Added

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 제로디
+Copyright (c) 2026 0disoft
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/docs/architecture.md

@@ -36,7 +36,7 @@ Generated paths, signatures, callers, references, timestamps, and hashes are nev
 {
   "schemaVersion": 1,
   "specVersion": "1",
-  "generatedBy": "llmnav@0.5.1",
+  "generatedBy": "llmnav@0.5.2",
   "repositoryId": "example",
   "contractFingerprints": {
     "schemaVersion": 1,

package/docs/migration.md

@@ -7,7 +7,7 @@ No source-card migration is required. Keep every `llmnav/1` comment and the exis
 Upgrade and regenerate:
 
 ```sh
-npm install --save-dev llmnav@^0.5.1
+npm install --save-dev llmnav@^0.5.2
 npx llmnav init --agents all
 npx llmnav generate
 npx llmnav doctor

package/docs/publishing.md

@@ -31,11 +31,11 @@ npm run release:check
 
 ## 3. Configure npm authentication
 
-The supplied release workflow uses npm provenance and GitHub's OIDC token. In npm package settings, configure the GitHub repository and `.github/workflows/release.yml` as a trusted publisher.
+The supplied release workflow uses GitHub's OIDC token through npm Trusted Publishers. The GitHub source repository is private, so the workflow explicitly disables provenance; npm accepts provenance only from public source repositories. If the repository becomes public, enable provenance in both `package.json` and the workflow after a successful release check.
 
 The workflow references a GitHub environment named `npm`. Create that environment for release protection, or remove the `environment` line when no environment gate is desired.
 
-A classic or granular access token can be used for a manual first publication. Do not commit `.npmrc` credentials or an npm token.
+A classic or granular access token can be used for a manual first publication. Do not commit `.npmrc` credentials or an npm token. npm may still require browser-backed two-factor authentication.
 
 ## 4. Validate the exact package payload
 
@@ -55,17 +55,17 @@ Manual publication:
 
 ```sh
 npm login
-npm publish --provenance --access public
+npm publish --provenance=false --access public
 ```
 
 Automated publication:
 
 ```sh
-git tag v0.5.1
-git push origin v0.5.1
+git tag v0.5.2
+git push origin v0.5.2
 ```
 
-The release workflow rejects a tag that does not match `package.json`.
+The release workflow rejects a tag that does not match `package.json`. If the exact version is already present in npm, the workflow succeeds only when the registry tarball integrity matches the tagged package; a mismatched package fails closed.
 
 ## 6. Verify from a clean directory
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llmnav",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "A deterministic semantic navigation layer for LLM coding agents.",
   "type": "module",
   "bin": {
@@ -60,7 +60,7 @@
     "cli",
     "lint"
   ],
-  "author": "제로디",
+  "author": "0disoft",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -74,6 +74,6 @@
   "types": "./src/index.d.ts",
   "publishConfig": {
     "access": "public",
-    "provenance": true
+    "provenance": false
   }
 }

package/src/spec.js

@@ -1,4 +1,4 @@
-export const PACKAGE_VERSION = "0.5.1";
+export const PACKAGE_VERSION = "0.5.2";
 export const SPEC_VERSION = "1";
 
 export const SCOPES = Object.freeze(["file", "module", "symbol"]);