release: 0.9.0 on spec ^0.19.2

[scarmuega]

Cuts 0.9.0 and fixes the spec dependency range. Two commits, separable:

1. fix(deps) — "@utxorpc/spec": "0.19.0" → "^0.19.2"
2. chore — "version": "0.8.2" → "0.9.0"

The pin was an exact version, not a range

"0.19.0" with no range operator is an exact pin in npm. Every other SDK expresses this dependency as a range that accepts patches — rust ^0.19.0, python poetry "0.19.2" (caret semantics), dotnet a minimum — so node was the only one that would never pick up 0.19.1 or 0.19.2 without a manual edit.

^0.19.2 resolves to >=0.19.2 <0.20.0, matching the caret semantics the rust SDK already uses for the same dependency.

This is why the published 0.8.2 sits on spec 0.18.1 while main said 0.19.0: the pin freezes whatever was written, so drift is silent until someone edits it by hand.

No workflow changes needed

release.yml has implemented npm trusted publishing since May — permissions: id-token: write, node 24.5.0 (bundles npm 11.5.1, the minimum for OIDC), registry-url set, npm publish --access public, and no secret references anywhere in the file. npm's OIDC flow is tokenless, so unlike the NuGet migration there's no login/exchange step to add.

The missing half was the trusted publisher policy on npmjs.org, which is now configured. Nothing in this repo needed to change for it.

Evidence the path has never run: @utxorpc/sdk@0.8.2 carries no attestations, i.e. it was published with a classic token. @utxorpc/spec@0.19.2 does carry SLSA provenance, so the mechanism is proven for the @utxorpc scope — just not yet for this package. Tagging v0.9.0 will be its first exercise, and a successful publish should produce provenance attestations.

The leftover NPM_TOKEN secret on this repo is referenced by nothing and can be revoked.

What this closes

@utxorpc/sdk is the last SDK behind the current spec. rust, go, python, dotnet and haskell all now ship against 0.19.2; this brings node to the same line.

🤖 Generated with Claude Code