From c052ec1fb1c6a0043e49bf229222149c7b1274fb Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 14:41:26 +0000
Subject: [PATCH] Version Packages

---
 .changeset/trusted-publishing.md              | 25 -------------------
 packages/core/CHANGELOG.md                    |  6 +++++
 packages/core/package.json                    |  2 +-
 packages/mcp/CHANGELOG.md                     | 18 +++++++++++++
 packages/mcp/package.json                     |  2 +-
 packages/provider-artic/CHANGELOG.md          |  8 ++++++
 packages/provider-artic/package.json          |  2 +-
 packages/provider-brave/CHANGELOG.md          |  8 ++++++
 packages/provider-brave/package.json          |  2 +-
 packages/provider-europeana/CHANGELOG.md      |  8 ++++++
 packages/provider-europeana/package.json      |  2 +-
 packages/provider-flickr/CHANGELOG.md         |  8 ++++++
 packages/provider-flickr/package.json         |  2 +-
 packages/provider-freesound/CHANGELOG.md      |  8 ++++++
 packages/provider-freesound/package.json      |  2 +-
 packages/provider-gutendex/CHANGELOG.md       |  8 ++++++
 packages/provider-gutendex/package.json       |  2 +-
 .../provider-internet-archive/CHANGELOG.md    |  8 ++++++
 .../provider-internet-archive/package.json    |  2 +-
 packages/provider-jamendo/CHANGELOG.md        |  8 ++++++
 packages/provider-jamendo/package.json        |  2 +-
 packages/provider-met/CHANGELOG.md            |  8 ++++++
 packages/provider-met/package.json            |  2 +-
 packages/provider-nailbook/CHANGELOG.md       |  8 ++++++
 packages/provider-nailbook/package.json       |  2 +-
 packages/provider-openverse/CHANGELOG.md      |  8 ++++++
 packages/provider-openverse/package.json      |  2 +-
 packages/provider-pexels/CHANGELOG.md         |  8 ++++++
 packages/provider-pexels/package.json         |  2 +-
 packages/provider-pixabay/CHANGELOG.md        |  8 ++++++
 packages/provider-pixabay/package.json        |  2 +-
 packages/provider-poetrydb/CHANGELOG.md       |  8 ++++++
 packages/provider-poetrydb/package.json       |  2 +-
 packages/provider-polyhaven/CHANGELOG.md      |  8 ++++++
 packages/provider-polyhaven/package.json      |  2 +-
 packages/provider-rijksmuseum/CHANGELOG.md    |  8 ++++++
 packages/provider-rijksmuseum/package.json    |  2 +-
 packages/provider-smithsonian/CHANGELOG.md    |  8 ++++++
 packages/provider-smithsonian/package.json    |  2 +-
 packages/provider-testkit/CHANGELOG.md        |  7 ++++++
 packages/provider-testkit/package.json        |  2 +-
 packages/provider-unsplash/CHANGELOG.md       |  8 ++++++
 packages/provider-unsplash/package.json       |  2 +-
 .../provider-wikimedia-commons/CHANGELOG.md   |  8 ++++++
 .../provider-wikimedia-commons/package.json   |  2 +-
 plugins/refkit/.claude-plugin/plugin.json     |  2 +-
 plugins/refkit/.codex-plugin/plugin.json      |  2 +-
 plugins/refkit/.mcp.json                      |  2 +-
 48 files changed, 208 insertions(+), 50 deletions(-)
 delete mode 100644 .changeset/trusted-publishing.md

diff --git a/.changeset/trusted-publishing.md b/.changeset/trusted-publishing.md
deleted file mode 100644
index e9f4943..0000000
--- a/.changeset/trusted-publishing.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-'@refkit/core': patch
-'@refkit/mcp': patch
-'@refkit/provider-artic': patch
-'@refkit/provider-brave': patch
-'@refkit/provider-europeana': patch
-'@refkit/provider-flickr': patch
-'@refkit/provider-freesound': patch
-'@refkit/provider-gutendex': patch
-'@refkit/provider-internet-archive': patch
-'@refkit/provider-jamendo': patch
-'@refkit/provider-met': patch
-'@refkit/provider-nailbook': patch
-'@refkit/provider-openverse': patch
-'@refkit/provider-pexels': patch
-'@refkit/provider-pixabay': patch
-'@refkit/provider-poetrydb': patch
-'@refkit/provider-polyhaven': patch
-'@refkit/provider-rijksmuseum': patch
-'@refkit/provider-smithsonian': patch
-'@refkit/provider-unsplash': patch
-'@refkit/provider-wikimedia-commons': patch
----
-
-Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index 4047a5f..13d4c18 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @refkit/core
 
+## 0.10.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+
 ## 0.10.0
 
 ### Minor Changes
diff --git a/packages/core/package.json b/packages/core/package.json
index 9deba5d..33370d5 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/core",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "refkit core — neutral reference-retrieval brain: Reference/RightsRecord contract, license normalization, strict-deny use-gate, RRF merge/dedup, ReferenceProvider interfaces. Zero-network, zero-provider, only zod.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
index b89143b..adccc4c 100644
--- a/packages/mcp/CHANGELOG.md
+++ b/packages/mcp/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @refkit/mcp
 
+## 0.9.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+  - @refkit/provider-artic@0.5.1
+  - @refkit/provider-gutendex@0.5.1
+  - @refkit/provider-internet-archive@0.6.1
+  - @refkit/provider-met@0.5.1
+  - @refkit/provider-nailbook@0.3.1
+  - @refkit/provider-openverse@0.6.1
+  - @refkit/provider-poetrydb@0.5.1
+  - @refkit/provider-polyhaven@0.5.1
+  - @refkit/provider-rijksmuseum@0.5.1
+  - @refkit/provider-wikimedia-commons@0.6.1
+
 ## 0.9.0
 
 ### Minor Changes
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
index 2de2fe2..2e4661f 100644
--- a/packages/mcp/package.json
+++ b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/mcp",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "MCP server for refkit — exposes license-normalized reference search as an agent tool.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-artic/CHANGELOG.md b/packages/provider-artic/CHANGELOG.md
index 49a51f0..842b13d 100644
--- a/packages/provider-artic/CHANGELOG.md
+++ b/packages/provider-artic/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-artic
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes
diff --git a/packages/provider-artic/package.json b/packages/provider-artic/package.json
index 093fd42..714abc5 100644
--- a/packages/provider-artic/package.json
+++ b/packages/provider-artic/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-artic",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Art Institute of Chicago provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-brave/CHANGELOG.md b/packages/provider-brave/CHANGELOG.md
index e597d67..0059632 100644
--- a/packages/provider-brave/CHANGELOG.md
+++ b/packages/provider-brave/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-brave
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes
diff --git a/packages/provider-brave/package.json b/packages/provider-brave/package.json
index 4169d51..4077a63 100644
--- a/packages/provider-brave/package.json
+++ b/packages/provider-brave/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-brave",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Brave Search web-discovery provider satellite for refkit — open-web image breadth, license:unknown (use-gated to needs-review).",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-europeana/CHANGELOG.md b/packages/provider-europeana/CHANGELOG.md
index 67737ab..aad487e 100644
--- a/packages/provider-europeana/CHANGELOG.md
+++ b/packages/provider-europeana/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-europeana
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes
diff --git a/packages/provider-europeana/package.json b/packages/provider-europeana/package.json
index 3ddf912..d529857 100644
--- a/packages/provider-europeana/package.json
+++ b/packages/provider-europeana/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-europeana",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Europeana provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-flickr/CHANGELOG.md b/packages/provider-flickr/CHANGELOG.md
index fa2ffe1..84fd4f2 100644
--- a/packages/provider-flickr/CHANGELOG.md
+++ b/packages/provider-flickr/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-flickr
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes
diff --git a/packages/provider-flickr/package.json b/packages/provider-flickr/package.json
index 5a2e6ad..895b0ef 100644
--- a/packages/provider-flickr/package.json
+++ b/packages/provider-flickr/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-flickr",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Flickr provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-freesound/CHANGELOG.md b/packages/provider-freesound/CHANGELOG.md
index 6d13201..178c9c5 100644
--- a/packages/provider-freesound/CHANGELOG.md
+++ b/packages/provider-freesound/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-freesound
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes
diff --git a/packages/provider-freesound/package.json b/packages/provider-freesound/package.json
index df7ee13..ae16547 100644
--- a/packages/provider-freesound/package.json
+++ b/packages/provider-freesound/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-freesound",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Freesound provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-gutendex/CHANGELOG.md b/packages/provider-gutendex/CHANGELOG.md
index 732d648..b4b1f4a 100644
--- a/packages/provider-gutendex/CHANGELOG.md
+++ b/packages/provider-gutendex/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-gutendex
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes
diff --git a/packages/provider-gutendex/package.json b/packages/provider-gutendex/package.json
index d8c4366..9e06de5 100644
--- a/packages/provider-gutendex/package.json
+++ b/packages/provider-gutendex/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-gutendex",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Gutendex (Project Gutenberg) provider satellite for refkit — public-domain book references, per-item copyright→license.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-internet-archive/CHANGELOG.md b/packages/provider-internet-archive/CHANGELOG.md
index c27f8d5..35f580e 100644
--- a/packages/provider-internet-archive/CHANGELOG.md
+++ b/packages/provider-internet-archive/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-internet-archive
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes
diff --git a/packages/provider-internet-archive/package.json b/packages/provider-internet-archive/package.json
index a1a8a23..7b40a83 100644
--- a/packages/provider-internet-archive/package.json
+++ b/packages/provider-internet-archive/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-internet-archive",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Internet Archive provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-jamendo/CHANGELOG.md b/packages/provider-jamendo/CHANGELOG.md
index 0a8e37c..f34b7e6 100644
--- a/packages/provider-jamendo/CHANGELOG.md
+++ b/packages/provider-jamendo/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-jamendo
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes
diff --git a/packages/provider-jamendo/package.json b/packages/provider-jamendo/package.json
index 2a4201d..2f8ba9e 100644
--- a/packages/provider-jamendo/package.json
+++ b/packages/provider-jamendo/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-jamendo",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Jamendo provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-met/CHANGELOG.md b/packages/provider-met/CHANGELOG.md
index 6181ae3..4251b8f 100644
--- a/packages/provider-met/CHANGELOG.md
+++ b/packages/provider-met/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-met
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes
diff --git a/packages/provider-met/package.json b/packages/provider-met/package.json
index 23c31b4..f5398b3 100644
--- a/packages/provider-met/package.json
+++ b/packages/provider-met/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-met",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "The Metropolitan Museum of Art provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-nailbook/CHANGELOG.md b/packages/provider-nailbook/CHANGELOG.md
index 317e941..090d99d 100644
--- a/packages/provider-nailbook/CHANGELOG.md
+++ b/packages/provider-nailbook/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-nailbook
 
+## 0.3.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/provider-nailbook/package.json b/packages/provider-nailbook/package.json
index b56f6a6..137fa9c 100644
--- a/packages/provider-nailbook/package.json
+++ b/packages/provider-nailbook/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-nailbook",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Nailbook (nailbook.jp) nail-design provider satellite for refkit — keyless Japanese nail-art image references.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-openverse/CHANGELOG.md b/packages/provider-openverse/CHANGELOG.md
index 0939eb0..3973ac3 100644
--- a/packages/provider-openverse/CHANGELOG.md
+++ b/packages/provider-openverse/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-openverse
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes
diff --git a/packages/provider-openverse/package.json b/packages/provider-openverse/package.json
index 98e2c8f..90ab1cf 100644
--- a/packages/provider-openverse/package.json
+++ b/packages/provider-openverse/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-openverse",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Openverse provider satellite for refkit — CC/PD licensed image search, license-normalized.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-pexels/CHANGELOG.md b/packages/provider-pexels/CHANGELOG.md
index 0cdc16a..db18526 100644
--- a/packages/provider-pexels/CHANGELOG.md
+++ b/packages/provider-pexels/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-pexels
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes
diff --git a/packages/provider-pexels/package.json b/packages/provider-pexels/package.json
index 759263b..f611bcf 100644
--- a/packages/provider-pexels/package.json
+++ b/packages/provider-pexels/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-pexels",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Pexels provider satellite for refkit — image search, hotlink-required.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-pixabay/CHANGELOG.md b/packages/provider-pixabay/CHANGELOG.md
index ac6f658..3edfb28 100644
--- a/packages/provider-pixabay/CHANGELOG.md
+++ b/packages/provider-pixabay/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-pixabay
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes
diff --git a/packages/provider-pixabay/package.json b/packages/provider-pixabay/package.json
index 08b6d90..0f8a9ef 100644
--- a/packages/provider-pixabay/package.json
+++ b/packages/provider-pixabay/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-pixabay",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Pixabay provider satellite for refkit — image search, cache-allowed.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-poetrydb/CHANGELOG.md b/packages/provider-poetrydb/CHANGELOG.md
index 4b916d0..ae3d07c 100644
--- a/packages/provider-poetrydb/CHANGELOG.md
+++ b/packages/provider-poetrydb/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-poetrydb
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes
diff --git a/packages/provider-poetrydb/package.json b/packages/provider-poetrydb/package.json
index c644600..8ce2046 100644
--- a/packages/provider-poetrydb/package.json
+++ b/packages/provider-poetrydb/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-poetrydb",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "PoetryDB provider satellite for refkit — classic public-domain poems.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-polyhaven/CHANGELOG.md b/packages/provider-polyhaven/CHANGELOG.md
index 84af7f1..fd8997d 100644
--- a/packages/provider-polyhaven/CHANGELOG.md
+++ b/packages/provider-polyhaven/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-polyhaven
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes
diff --git a/packages/provider-polyhaven/package.json b/packages/provider-polyhaven/package.json
index 206f456..3b2390d 100644
--- a/packages/provider-polyhaven/package.json
+++ b/packages/provider-polyhaven/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-polyhaven",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Poly Haven provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-rijksmuseum/CHANGELOG.md b/packages/provider-rijksmuseum/CHANGELOG.md
index 6c02152..25b6333 100644
--- a/packages/provider-rijksmuseum/CHANGELOG.md
+++ b/packages/provider-rijksmuseum/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-rijksmuseum
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes
diff --git a/packages/provider-rijksmuseum/package.json b/packages/provider-rijksmuseum/package.json
index bae4ce1..27741a7 100644
--- a/packages/provider-rijksmuseum/package.json
+++ b/packages/provider-rijksmuseum/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-rijksmuseum",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Rijksmuseum provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-smithsonian/CHANGELOG.md b/packages/provider-smithsonian/CHANGELOG.md
index 27e8ded..0debb1e 100644
--- a/packages/provider-smithsonian/CHANGELOG.md
+++ b/packages/provider-smithsonian/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-smithsonian
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes
diff --git a/packages/provider-smithsonian/package.json b/packages/provider-smithsonian/package.json
index fb25e1f..8caf86b 100644
--- a/packages/provider-smithsonian/package.json
+++ b/packages/provider-smithsonian/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-smithsonian",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Smithsonian Open Access provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-testkit/CHANGELOG.md b/packages/provider-testkit/CHANGELOG.md
index 525a6ff..f842dfd 100644
--- a/packages/provider-testkit/CHANGELOG.md
+++ b/packages/provider-testkit/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @refkit/provider-testkit
 
+## 0.1.3
+
+### Patch Changes
+
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.1.2
 
 ### Patch Changes
diff --git a/packages/provider-testkit/package.json b/packages/provider-testkit/package.json
index f9cd4f9..36230d9 100644
--- a/packages/provider-testkit/package.json
+++ b/packages/provider-testkit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-testkit",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": true,
   "description": "Conformance test helpers for refkit provider satellites (internal, not published).",
   "type": "module",
diff --git a/packages/provider-unsplash/CHANGELOG.md b/packages/provider-unsplash/CHANGELOG.md
index ab17d1b..198922b 100644
--- a/packages/provider-unsplash/CHANGELOG.md
+++ b/packages/provider-unsplash/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-unsplash
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes
diff --git a/packages/provider-unsplash/package.json b/packages/provider-unsplash/package.json
index 73fc8f2..1cba4fd 100644
--- a/packages/provider-unsplash/package.json
+++ b/packages/provider-unsplash/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-unsplash",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Unsplash provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-wikimedia-commons/CHANGELOG.md b/packages/provider-wikimedia-commons/CHANGELOG.md
index 2722911..b004cf9 100644
--- a/packages/provider-wikimedia-commons/CHANGELOG.md
+++ b/packages/provider-wikimedia-commons/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-wikimedia-commons
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes
diff --git a/packages/provider-wikimedia-commons/package.json b/packages/provider-wikimedia-commons/package.json
index ec5f56f..a97fb57 100644
--- a/packages/provider-wikimedia-commons/package.json
+++ b/packages/provider-wikimedia-commons/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-wikimedia-commons",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Wikimedia Commons provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/plugins/refkit/.claude-plugin/plugin.json b/plugins/refkit/.claude-plugin/plugin.json
index 24faadc..e9fc295 100644
--- a/plugins/refkit/.claude-plugin/plugin.json
+++ b/plugins/refkit/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "refkit",
   "displayName": "refkit",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "License-aware reference search for creative work: find images, art, textures, audio and text across open sources, with a use verdict and attribution line per result.",
   "author": {
     "name": "refkitjs",
diff --git a/plugins/refkit/.codex-plugin/plugin.json b/plugins/refkit/.codex-plugin/plugin.json
index 8ba2736..a92a39e 100644
--- a/plugins/refkit/.codex-plugin/plugin.json
+++ b/plugins/refkit/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "refkit",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "License-aware reference search for creative work: find images, art, textures, audio and text across open sources, with a use verdict and attribution line per result.",
   "author": {
     "name": "refkitjs",
diff --git a/plugins/refkit/.mcp.json b/plugins/refkit/.mcp.json
index 928f80d..cb885ea 100644
--- a/plugins/refkit/.mcp.json
+++ b/plugins/refkit/.mcp.json
@@ -4,7 +4,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@refkit/mcp@0.9.0"
+        "@refkit/mcp@0.9.1"
       ]
     }
   }