Changed
- CI / release: npm publishing for
@orcalang/orca-lang,@orcalang/orca-runtime-ts, and@orcalang/orca-mcp-servermigrated from a long-livedNPM_TOKENto OIDC trusted publishing. There is no stored npm credential anymore, and publishes now carry provenance attestations.release.ymlgainsid-token: writeon the three npm jobs, pinspnpm/action-setupto10.33.0(OIDC publish support requires pnpm ≥ 10.18), and dropsNODE_AUTH_TOKEN. The MCP-registry publish is token-less as well (npm ownership is verified via the publishedmcpNamefield). Added arepositoryfield to the three npmpackage.jsonfiles, required for provenance.
No functional or library changes — the train is version-bumped to stay in lockstep.