From 98aa1075e243f140dbf23588902a6f59ba3f655c Mon Sep 17 00:00:00 2001
From: Sergei Rudenkov <sergeirudenkov@google.com>
Date: Mon, 12 Oct 2026 10:19:56 +0000
Subject: [PATCH 1/2] Fix clean-checkout build and tests on Vite 8

`npm ci` (and thus the `prepare` script) failed on a fresh checkout:
Vite 8 ships an `exports`-only package.json, which TypeScript's legacy
`moduleResolution: "node"` cannot resolve, so rollup-plugin-dts bailed
out with TS2307 while generating `dist/index.d.ts`. Switch to
`moduleResolution: "bundler"`, which matches `module: "ESNext"` and the
rollup-based build.

Also fix the DNS-rebinding test, which assumed that the plugin's
middleware runs before Vite's built-in host validation (true on Vite
5/6, but not on Vite 8, where Vite answers the request first). Disable
Vite's check in that test via `allowedHosts: true` so that it exercises
the plugin's own Host-header check.
---
 test/index.test.ts | 4 ++++
 tsconfig.json      | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/test/index.test.ts b/test/index.test.ts
index 2eae9c0..3a19f51 100644
--- a/test/index.test.ts
+++ b/test/index.test.ts
@@ -145,6 +145,10 @@ describe('#VitePluginDevToolsJson', () => {
         server: {
           port,
           host: true,
+          // Disable Vite's built-in host validation, which (depending on the
+          // Vite version) runs before plugin middlewares and would answer this
+          // request itself, so that the plugin's own check is exercised.
+          allowedHosts: true,
         },
       });
 
diff --git a/tsconfig.json b/tsconfig.json
index fcc5f85..dcc8493 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -7,7 +7,7 @@
         "noImplicitAny": true,
         "noUnusedLocals": true,
         "module": "ESNext",
-        "moduleResolution": "node",
+        "moduleResolution": "bundler",
         "sourceMap": false,
         "outDir": "dist",
         "target": "ES2020",

From 7b6f1c115755e080ef18a0a1a0da6976899662d8 Mon Sep 17 00:00:00 2001
From: Sergei Rudenkov <sergeirudenkov@google.com>
Date: Mon, 12 Oct 2026 10:20:00 +0000
Subject: [PATCH 2/2] Publish to npm via Trusted Publishing with provenance

Wombat Dressing Room is deprecated and will be turned down in January
2027. Add a `publish-on-tag` GitHub Actions workflow that publishes the
package via npm Trusted Publishing (OIDC) with provenance attestation
whenever a tag is pushed, matching the trusted publisher configured for
this repository on npmjs.com (workflow file `publish-on-tag.yml`).

- Remove the Wombat `publishConfig.registry` from package.json, which
  would otherwise override the registry used by `npm publish`.
- Add `.nvmrc` (Node 24, which bundles npm >= 11.5.1 as required for
  Trusted Publishing).
- Document the new tag-based release flow in the README.
---
 .github/workflows/publish-on-tag.yml | 38 ++++++++++++++++++++++++++++
 .nvmrc                               |  1 +
 README.md                            | 20 +++++++++++++--
 package.json                         |  3 ---
 4 files changed, 57 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/publish-on-tag.yml
 create mode 100644 .nvmrc

diff --git a/.github/workflows/publish-on-tag.yml b/.github/workflows/publish-on-tag.yml
new file mode 100644
index 0000000..9aa0a42
--- /dev/null
+++ b/.github/workflows/publish-on-tag.yml
@@ -0,0 +1,38 @@
+name: publish-on-tag
+
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # Required for OIDC (npm Trusted Publishing)
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          cache: npm
+          node-version-file: '.nvmrc'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm test
+
+      - name: Publish
+        run: npm publish --provenance --access public
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..54c6511
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+v24
diff --git a/README.md b/README.md
index cfe3d01..3274921 100644
--- a/README.md
+++ b/README.md
@@ -86,8 +86,24 @@ project illustrating how to use the plugin in practice.
 
 ## Publishing
 
-**Googlers:** We use [go/wombat-dressing-room](http://go/wombat-dressing-room)
-for publishing.
+The package is published to npm by the
+[`publish-on-tag`](.github/workflows/publish-on-tag.yml) GitHub Actions
+workflow, which uses npm [trusted publishing](https://docs.npmjs.com/trusted-publishers)
+(no npm tokens involved) and generates
+[provenance attestations](https://docs.npmjs.com/generating-provenance-statements).
+
+To publish a new version:
+
+1. Bump the `version` in `package.json` and land that change on `main`.
+2. Tag the release commit and push the tag:
+
+   ```sh
+   git tag v1.2.3
+   git push origin v1.2.3
+   ```
+
+Pushing the tag triggers the workflow, which builds and tests the package and
+then runs `npm publish`.
 
 ## License
 
diff --git a/package.json b/package.json
index 8314ef3..81763cb 100644
--- a/package.json
+++ b/package.json
@@ -71,8 +71,5 @@
     "typescript": "^5.7.3",
     "vite": "^8.0.16",
     "vitest": "^4.1.8"
-  },
-  "publishConfig": {
-    "registry": "https://wombat-dressing-room.appspot.com"
   }
 }