MyPrototypeWhat · Oct 26, 2026 · Oct 26, 2026
diff --git a/.changeset/trusted-publishing.md b/.changeset/trusted-publishing.md
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @refkit/core
 
+## 0.10.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+
 ## 0.10.0
 
 ### Minor Changes

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/core",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "refkit core — neutral reference-retrieval brain: Reference/RightsRecord contract, license normalization, strict-deny use-gate, RRF merge/dedup, ReferenceProvider interfaces. Zero-network, zero-provider, only zod.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @refkit/mcp
 
+## 0.9.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+  - @refkit/provider-artic@0.5.1
+  - @refkit/provider-gutendex@0.5.1
+  - @refkit/provider-internet-archive@0.6.1
+  - @refkit/provider-met@0.5.1
+  - @refkit/provider-nailbook@0.3.1
+  - @refkit/provider-openverse@0.6.1
+  - @refkit/provider-poetrydb@0.5.1
+  - @refkit/provider-polyhaven@0.5.1
+  - @refkit/provider-rijksmuseum@0.5.1
+  - @refkit/provider-wikimedia-commons@0.6.1
+
 ## 0.9.0
 
 ### Minor Changes

diff --git a/packages/mcp/package.json b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/mcp",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "MCP server for refkit — exposes license-normalized reference search as an agent tool.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-artic/CHANGELOG.md b/packages/provider-artic/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-artic
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes

diff --git a/packages/provider-artic/package.json b/packages/provider-artic/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-artic",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Art Institute of Chicago provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-brave/CHANGELOG.md b/packages/provider-brave/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-brave
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes

diff --git a/packages/provider-brave/package.json b/packages/provider-brave/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-brave",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Brave Search web-discovery provider satellite for refkit — open-web image breadth, license:unknown (use-gated to needs-review).",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-europeana/CHANGELOG.md b/packages/provider-europeana/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-europeana
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes

diff --git a/packages/provider-europeana/package.json b/packages/provider-europeana/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-europeana",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Europeana provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-flickr/CHANGELOG.md b/packages/provider-flickr/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-flickr
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes

diff --git a/packages/provider-flickr/package.json b/packages/provider-flickr/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-flickr",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Flickr provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-freesound/CHANGELOG.md b/packages/provider-freesound/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-freesound
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes

diff --git a/packages/provider-freesound/package.json b/packages/provider-freesound/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-freesound",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Freesound provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-gutendex/CHANGELOG.md b/packages/provider-gutendex/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-gutendex
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes

diff --git a/packages/provider-gutendex/package.json b/packages/provider-gutendex/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-gutendex",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Gutendex (Project Gutenberg) provider satellite for refkit — public-domain book references, per-item copyright→license.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-internet-archive/CHANGELOG.md b/packages/provider-internet-archive/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-internet-archive
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes

diff --git a/packages/provider-internet-archive/package.json b/packages/provider-internet-archive/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-internet-archive",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Internet Archive provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-jamendo/CHANGELOG.md b/packages/provider-jamendo/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-jamendo
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes

diff --git a/packages/provider-jamendo/package.json b/packages/provider-jamendo/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-jamendo",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Jamendo provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-met/CHANGELOG.md b/packages/provider-met/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-met
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes

diff --git a/packages/provider-met/package.json b/packages/provider-met/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-met",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "The Metropolitan Museum of Art provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-nailbook/CHANGELOG.md b/packages/provider-nailbook/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-nailbook
 
+## 0.3.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.3.0
 
 ### Minor Changes

diff --git a/packages/provider-nailbook/package.json b/packages/provider-nailbook/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-nailbook",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Nailbook (nailbook.jp) nail-design provider satellite for refkit — keyless Japanese nail-art image references.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-openverse/CHANGELOG.md b/packages/provider-openverse/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-openverse
 
+## 0.6.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.6.0
 
 ### Minor Changes

diff --git a/packages/provider-openverse/package.json b/packages/provider-openverse/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-openverse",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Openverse provider satellite for refkit — CC/PD licensed image search, license-normalized.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-pexels/CHANGELOG.md b/packages/provider-pexels/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-pexels
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes

diff --git a/packages/provider-pexels/package.json b/packages/provider-pexels/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-pexels",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Pexels provider satellite for refkit — image search, hotlink-required.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-pixabay/CHANGELOG.md b/packages/provider-pixabay/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-pixabay
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes

diff --git a/packages/provider-pixabay/package.json b/packages/provider-pixabay/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-pixabay",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Pixabay provider satellite for refkit — image search, cache-allowed.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-poetrydb/CHANGELOG.md b/packages/provider-poetrydb/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-poetrydb
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes

diff --git a/packages/provider-poetrydb/package.json b/packages/provider-poetrydb/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-poetrydb",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "PoetryDB provider satellite for refkit — classic public-domain poems.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-polyhaven/CHANGELOG.md b/packages/provider-polyhaven/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @refkit/provider-polyhaven
 
+## 0.5.1
+
+### Patch Changes
+
+- a983747: Published from GitHub Actions through npm trusted publishing (OIDC) instead of a long-lived npm token, so every version now carries a signed provenance statement that links it to the exact commit and workflow run that built it. No code changes.
+- Updated dependencies [a983747]
+  - @refkit/core@0.10.1
+
 ## 0.5.0
 
 ### Minor Changes