hook-contract 0.1.1 🥇

First release cut through the OIDC pipeline — and the one that reconciles npm ⇔ PyPI to content + version parity.

What 0.1.1 does

Proves the OIDC npm pipeline (#2096) end-to-end on a real tagged release — no NPM_TOKEN.
Reconciles the registries: npm 0.1.0 (today's bootstrap) shipped signing; PyPI 0.1.0 (2026-05-18) predated it. 0.1.1 brings PyPI's signing module out of "Unreleased" so both registries are content-equivalent at 0.1.1.
No contract/code changes beyond release infra + the repository.url normalization. The 19 events + schemas are unchanged.

The FOUR version sources (all must equal the tag)

A bump that misses any one trips the parity preflight. 0.1.1 touched all four:

source	file	0.1.1?
npm package	packages/hook-contract/package.json	✅
runtime const	src/index.ts · HOOK_CONTRACT_VERSION	✅
PyPI project	hook-contract-py/pyproject.toml	✅
py runtime	__init__.py · __version__ (preflight blind-spot!)	✅

Note: the py preflight only checks pyproject; __init__.py is a 4th source that can silently drift — bumped here, worth adding to the py preflight later.

Release command (after merge)

git tag hook-contract-npm/v0.1.1 hook-contract-py/v0.1.1
git push origin hook-contract-npm/v0.1.1 hook-contract-py/v0.1.1

Each tag → its OIDC publish workflow → preflight parity gate → publish with provenance → you approve the npm environment gate → live.

Parity check (try the tag)

tag version (all 4 sources are 0.1.1)