v0.5.2
First release published via OIDC trusted publishing — no npm token involved.
repository.urlnormalized togit+https://(npm pkg fix), silencing the warning npm emitted on every publish.- Proves the
publish.ymlpath end-to-end: 0.5.1 was published manually because npm cannot configure a trusted publisher for a package that does not yet exist.
Expect a build provenance attestation on this version; 0.5.1 has none.