v0.5.2 — npm provenance + Astro catalog auto-discovery
Highlights
Supply-chain hardening — every `@dualmark/*` tarball is now signed with npm provenance attestation. Each package on npmjs.com gets a verified "Provenance" badge tying the artifact to this exact GitHub Actions workflow run and commit SHA. Consumers can verify with:
```bash
npm audit signatures
```
No API changes inside any package — this is a release-pipeline upgrade.
Changes
`@dualmark/astro` 0.5.2
- ✨ Added `seo`, `performance`, `optimization` keywords to enable auto-discovery by the Astro Integrations catalog. `@dualmark/astro` will appear under "Performance + SEO" on the next weekly catalog sync (no runtime change).
All `@dualmark/*` packages 0.5.2
- 🔐 Release pipeline switched from `bun publish` to `bun pm pack` + `npm publish --provenance` (because bun 1.3.5 doesn't yet support `--provenance` — see oven-sh/bun#15601).
- 📝 `CONTRIBUTING.md` updated with the new release flow + how to verify provenance.