From cb5629f88f06ead0b4d0082c95a7fa39c7a1b0ea Mon Sep 17 00:00:00 2001
From: soufian3hm <Soufian3hm@gmail.com>
Date: Tue, 14 Jul 2026 23:53:29 +0100
Subject: [PATCH 1/2] build(release): attach npm provenance on publish

Set publishConfig.provenance in both SDK packages so attestations
attach independent of NPM_CONFIG_PROVENANCE, which did not survive
the changesets -> pnpm publish chain (0.2.1 published without
dist.attestations). The release workflow env stays as belt and braces.

Closes #65
---
 .changeset/attach-npm-provenance.md | 6 ++++++
 packages/client/package.json        | 3 ++-
 packages/react/package.json         | 3 ++-
 3 files changed, 10 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/attach-npm-provenance.md

diff --git a/.changeset/attach-npm-provenance.md b/.changeset/attach-npm-provenance.md
new file mode 100644
index 0000000..edc91a4
--- /dev/null
+++ b/.changeset/attach-npm-provenance.md
@@ -0,0 +1,6 @@
+---
+"@chimely/client": patch
+"@chimely/react": patch
+---
+
+Attach npm provenance via `publishConfig.provenance`. The `NPM_CONFIG_PROVENANCE` env did not survive the changesets -> `pnpm publish` chain, so 0.2.1 shipped without `dist.attestations`. Setting it per package is tool-agnostic; the release workflow env stays as belt and braces.
diff --git a/packages/client/package.json b/packages/client/package.json
index 0ef4801..ccfd026 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -42,7 +42,8 @@
     "vitest": "^4.1.8"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "repository": {
     "type": "git",
diff --git a/packages/react/package.json b/packages/react/package.json
index 3b13e55..224f966 100644
--- a/packages/react/package.json
+++ b/packages/react/package.json
@@ -57,7 +57,8 @@
     "vitest": "^4.1.8"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "repository": {
     "type": "git",

From 611bb2597374c8ea6610bcc03facc4e6d966c3df Mon Sep 17 00:00:00 2001
From: soufian3hm <Soufian3hm@gmail.com>
Date: Wed, 15 Jul 2026 13:59:37 +0100
Subject: [PATCH 2/2] build(release): drop the changeset, not needed for a
 publishConfig change

---
 .changeset/attach-npm-provenance.md | 6 ------
 1 file changed, 6 deletions(-)
 delete mode 100644 .changeset/attach-npm-provenance.md

diff --git a/.changeset/attach-npm-provenance.md b/.changeset/attach-npm-provenance.md
deleted file mode 100644
index edc91a4..0000000
--- a/.changeset/attach-npm-provenance.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-"@chimely/client": patch
-"@chimely/react": patch
----
-
-Attach npm provenance via `publishConfig.provenance`. The `NPM_CONFIG_PROVENANCE` env did not survive the changesets -> `pnpm publish` chain, so 0.2.1 shipped without `dist.attestations`. Setting it per package is tool-agnostic; the release workflow env stays as belt and braces.