Release v0.5.0

[miguelcolmenares]

Changes

Fixed

• All 8 subpath exports were unresolvable in the published 0.4.0. Every subpath's import.default pointed at a .mjs file the tsup build never produced — publint confirmed all 8 missing against the published tarball. The tsdown migration below is what actually builds the files the exports map has declared since 0.4.0.
• node10 module resolution failed for every subpath. Added typesVersions mapping each to its .d.ts.
• repository.url now a full git+https:// URL.

Changed

• Replaced tsup with tsdown (unmaintained, unbounded TypeScript peer range).
• Node 22 minimum, matching what CI actually runs.
• npm publishing moved to trusted publishing (OIDC) — no token in the repo.
• Standardized Dependabot auto-merge, added husky hooks.

Verification

Clean-room (rm -rf node_modules dist && npm ci): check ✅, build ✅, publint → All good!, attw → all 8 entry points 🟢 across node10, node16 (CJS+ESM), bundler.

After merge

publish.yml triggers on release: [created] — a bare tag will not fire it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.