chore(release): 1.10.0

[kevinccbsg]

Two commits: the version bump, and the npm provenance change you asked about.

Release: 1.10.0

Per the process in CLAUDE.md:

• package.json to 1.10.0
• src/constants/version.ts and src/constants/version_cli.js to 1.10.0. These drive the service worker handshake, so a mismatch breaks request mocking rather than just showing a wrong number. src/tests/version.spec.ts asserts they equal package.json
• package-lock.json refreshed by npm install
• A hand-written CHANGELOG.md entry

Verified in the built output: the version reaches dist/mock-sw.js, dist/bundled.es.js and the chunk carrying mockBridge, and no stale 1.9.0 is left anywhere in dist/.

Why this is not a major, even with a removal

twd.viewport() and twd.resetViewport() are gone. That is a public API removal, and normally it would be a major.

It is not one here because usage of that command is effectively nil, and it shipped in 1.6.0 as a beta that did not survive contact with real users. The CHANGELOG says all of that plainly, including that anyone calling those methods has to drop the calls, so the warning lands even though the version number does not carry it.

What is in the release

• twd.matchLayout, layout snapshots in the browser with no SaaS account and no containers. Ships as a beta feature: strictly additive, skipped in the sidebar unless you opt in, and it needs twd-cli 1.6.0 or newer to actually decide a snapshot.
• The twdSnapshot Vite plugin, plus the fix from fix(matchLayout): load the snapshot plugin, and say where the layout moved #339 without which it died on startup.
• Failure diagnostics: the route and mock-rule state on a failure.
• The sidebar execution speed selector, and the pacing-state fix behind it.
• The twd.viewport() removal.
• 14 dependabot bumps.

npm provenance

You asked whether to add --provenance, and pointed at ci.yml. It belongs in publish.yml instead, since that is the workflow that runs npm publish; ci.yml only runs tests.

Worth doing, yes. It attaches a signed attestation linking each published tarball to the exact commit and workflow run that built it, which npm shows as a Provenance badge on the package page.

The value is not that it prevents a bad publish. It is that it makes one visible: a version pushed from a stolen NPM_TOKEN on someone's laptop carries no attestation, and that gap is public and checkable by anyone.

Requirements, all already true here except the last:

• public repo: yes
• public npm package: yes, --access public is already passed
• published from GitHub Actions: yes, on release: published
• npm 9.5 or newer: yes, node 24
• id-token: write on the job: added in this PR, since the attestation is signed with a GitHub OIDC token

The one thing to know before merging: once this is on, publishing by hand from a laptop produces a version with no provenance, which looks worse than never having had it. Since publishing here is driven entirely by GitHub Releases, that should not come up. It also means a publish will now fail outright if the OIDC permission is ever removed, rather than silently shipping unsigned. That is the behaviour you want.

Verification

• 508 tests passing across 66 files
• lint, npm run build and npm run docs:build all clean