Repository navigation
@edgeproc/errors 0.1.1
The code is byte-identical to 0.1.0. What changes is provenance.
0.1.0 was published by hand, so it carries no attestation — npm has no "pending publisher" state, so a package name must exist before a trusted publisher can attach, and the first publish of any name therefore cannot use OIDC. A published version is immutable, so 0.1.0 can never be fixed retroactively.
0.1.1 is the first release through the trusted-publisher rail, signed into npm's transparency log by GitHub OIDC with no credential in the repo.
Verify: npm view @edgeproc/errors@0.1.1 dist.attestations → predicateType: https://slsa.dev/provenance/v1.