chore: npm Trusted Publishing (Node 24) + 0.6.1 republish

.github/workflows/publish.yml

@@ -32,7 +32,7 @@ jobs:
 
       - uses: actions/setup-node@v5
         with:
-          node-version: 22
+          node-version: 24 # npm >= 11.5.1 is required for OIDC trusted publishing; Node 22 bundles npm 10
           cache: npm
           registry-url: https://registry.npmjs.org
 
@@ -59,10 +59,11 @@ jobs:
             fs.writeFileSync('release-notes.md', lines.slice(start + 1, end).join('\n').trim() + '\n');
           "
 
+      # Auth is npm Trusted Publishing (OIDC): the registry trusts this
+      # repo + workflow file via `id-token: write` above, so no NPM_TOKEN.
+      # A token in NODE_AUTH_TOKEN would take precedence and bypass OIDC.
       - name: Publish package
         run: npm publish --access public --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create GitHub Release (creates the tag on workflow_dispatch)
         uses: softprops/action-gh-release@v3

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.6.1 (2026-11-09)
+
+Republish — no code changes. npm releases now go through Trusted Publishing
+(OIDC from `publish.yml`, Node 24 / npm 11) instead of a long-lived token;
+this version is the one that validates the connection. The browser extension
+is on its own version track and is unaffected.
+/ 재배포 — 코드 무변경. npm 발행이 토큰 대신 Trusted Publishing(OIDC)으로
+전환되었고, 이 버전이 그 연결을 검증합니다. 브라우저 확장은 별도 트랙이라
+무관합니다.
+
 ## 0.6.0 (2026-08-12)
 
 ### Added

README.ko.md

@@ -314,7 +314,7 @@ peer dependency이고 Svelte는 그마저 없어서, 코어는 여전히 zero-de
 Edge는 [보류](./extension/store/listing.md)입니다.
 
 > 확장은 **자체 버전 트랙을 가진 별도 산출물**입니다(현재 확장 0.7.0,
-> 라이브러리 0.6.0 — 두 번호는 무관합니다). 소스는
+> 라이브러리 0.6.1 — 두 번호는 무관합니다). 소스는
 > [extension/](./extension/).
 
 **Firefox 사용자:** MV3는 설치만으로 사이트 접근 권한을 주지 않아 확장이

README.md

@@ -320,7 +320,7 @@ Install: **[Chrome](https://chromewebstore.google.com/detail/kokey-%E2%80%94-wro
 Edge is [on hold](./extension/store/listing.md).
 
 > The extension is a **separate deliverable on its own version track** (it is
-> at 0.7.0 while the library is at 0.6.0 — the numbers are unrelated). Source
+> at 0.7.0 while the library is at 0.6.1 — the numbers are unrelated). Source
 > in [extension/](./extension/).
 
 **Firefox users:** MV3 grants no site access at install, so the extension

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devslab/kokey",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "publishConfig": {
     "access": "public"
   },