v1.4.0

Added

• releasePrefix in npm policies: namespaces the npm flow's release tags (types-v1.2.3) so a repository with more than one release flow keeps independent histories; threaded through version derivation, the conventional commit range, and a tag-namespace guard in npm-release.yml
• d1Migrations in deployment policies: D1 migrations apply inside cloudflare-version.yml immediately before each deploy — deploy only, never preview, per-target --env, from the deployment working directory's wrangler configuration

Changed

• npm publishes request --provenance only when the source repository is public; the registry refuses provenance from private repositories (E422), which failed every private-repository publish
• npm-publish.yml runs its package-scoped steps (version write, name read, publish) in the npm policy's workingDirectory, matching npm-pr.yml and npm-main.yml — npm publish from a workspace root packed the root package
• npm-main.yml strips the configured release prefix when deriving publishable versions
• advance internal pins to the v1.4.0 implementation, which also makes the v1.3.4 conventional-bump metadata script reachable for the first time

Validation

• pnpm install --frozen-lockfile
• pnpm run lint, 79 Node tests, actionlint
• scripts/policy.bundle.mjs regenerated via pnpm build