Publish to npm via Trusted Publishing with provenance

[Sergei-Rudenkov]

This migrates the package to npm Trusted Publishing with provenance attestation via a publish-on-tag GitHub Actions workflow. The trusted publisher for this repository has already been configured on npmjs.com (workflow filename publish-on-tag.yml, no environment).

Changes

Publish to npm via Trusted Publishing with provenance

• .github/workflows/publish-on-tag.yml (new): on tag push → npm ci → npm run build → npm test → npm publish --provenance --access public. id-token: write is scoped to the publish job (top-level permissions are read-only) and both actions are pinned to commit SHAs, matching ChromeDevTools/chrome-devtools-mcp. Based on emoji-test-regex-pattern's workflow.
• package.json: drop the Wombat publishConfig.registry — it would override the registry used by npm publish, so the OIDC exchange would never reach npmjs.org.
• .nvmrc: Node 24, which bundles npm ≥ 11.5.1 (required for Trusted Publishing), so no npm install -g npm@latest step is needed.
• README.md: document the new tag-based release flow.

Fix clean-checkout build and tests on Vite 8

Pre-existing on main, but the workflow runs exactly these steps, so the first tagged release would otherwise fail before reaching npm publish:

• tsconfig.json: moduleResolution: "node" → "bundler". Vite 8 ships an exports-only package.json (no top-level types), which node10 resolution cannot see, so rollup-plugin-dts aborted the prepare script with TS2307: Cannot find module 'vite'.
• test/index.test.ts: the DNS-rebinding test assumed the plugin's middleware runs before Vite's built-in host validation (true on Vite 5/6); on Vite 8 Vite registers hostValidationMiddleware before configureServer hooks and answers the request itself. Setting allowedHosts: true in that test disables Vite's check so the test exercises the plugin's own Host-header guard.

Verification

Clean room with Node 24.21 / npm 11.19:

• rm -rf node_modules dist && npm ci ✅ (fails on main)
• npm run build ✅ → dist/index.cjs, dist/index.d.ts, dist/index.mjs
• npm test ✅ 7/7 (6/7 on main)
• npm pack --dry-run → 6 files: LICENSE, README.md, dist/*, package.json

The OIDC exchange itself can only be exercised by a real tag push from this repository.

Releasing after this lands

Bump version in package.json on main, then git tag vX.Y.Z && git push origin vX.Y.Z. The run's log should show the provenance/transparency-log entry, and npmjs.com will show the "Provenance" badge for the release.