Restore npm trusted publishing for the pending release

.github/workflows/release.yml

@@ -27,10 +27,12 @@ jobs:
       - run: yarn install --immutable
       # Never version or publish a manifest whose dependencies point at local files.
       - run: node scripts/assert-publishable.ts
+      # Keep the maintained Changesets 2 npm publisher: v3 selects Yarn, whose bundled
+      # provenance client fails this release with a duplicate transparency-log entry.
       - uses: changesets/action@66d7d1ddafddf1ef45f98ee51a7496f9cdadb2f4 # v2.1.2
         with:
           version-script: corepack yarn changeset version
           publish-script: corepack yarn changeset publish
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          YARN_NPM_PUBLISH_PROVENANCE: "true"
+          NPM_CONFIG_PROVENANCE: "true"

CONTRIBUTING.md

@@ -310,6 +310,11 @@ so breaking changes are allowed but must be described in the changeset.
 yarn changeset
 ```
 
-2. Commit and push it to `main`.
+2. Commit it on a branch and merge the reviewed PR into `main`.
 3. The Changesets workflow will open a “Version Packages” PR.
 4. Merge that PR to publish to npm and tag the release.
+
+Yarn installs and builds the project. Changesets is pinned to the maintained 2.x publisher so
+the release uses npm's trusted-publishing/OIDC and provenance support. Changesets 3 switches a
+Yarn workspace to Yarn's publisher; do not upgrade it until that path passes publication with
+provenance enabled. The 0.6.1 release hit a duplicate transparency-log entry in that path.

package.json

@@ -92,7 +92,7 @@
   "devDependencies": {
     "@auth/core": "^0.41.3",
     "@biomejs/biome": "^2.5.14",
-    "@changesets/cli": "^3.0.3",
+    "@changesets/cli": "2.31.1",
     "@convex-dev/auth": "^0.0.95",
     "@edge-runtime/vm": "^5.0.0",
     "@fal-ai/client": "^1.10.1",