0.3.0

[jackmisner]

Release branch for 0.3.0, plus a README correction found during release prep.

Status: 0.3.0 is already on npm

The publish workflow ran on the v0.3.0 tag push and completed the npm publish (published 11:10:35). I attempted to cancel mid-run to hold it for the README check, but the cancellation only caught the later GitHub release job — the publish step had already succeeded.

Two consequences:

1. npm 0.3.0 carries the pre-fix README. The published code is correct and complete; only the docs in the tarball are behind. A 0.3.1 patch will correct it.
2. There is no GitHub Release for v0.3.0 — that job was cancelled. The 0.3.1 release will create its own; v0.3.0 can be tagged retroactively on GitHub if you want the history complete.

What 0.3.0 contains

• @jackmisner/utm-toolkit/server — DOM-free normalizeUtmParams / normalizeUtmUrl with total output and a never-throws contract for untrusted request bodies
• captureUtmParametersWithReport — distinguishes "no campaign" from "campaign rejected", and both from an unparseable URL
• Three capture options — lowercaseValues, sanitize.onMaxLength, sanitize.valuePattern
• Toolchain — vitest 4, jsdom 30, advisories 14 → 1 (low, dev-only); CI on Node 22/24/26; engines.node >=20.0.0

The README fix in this branch

Three gaps, the first consumer-facing:

• No Node requirement stated anywhere. engines.node moved >=16.0.0 → >=20.0.0, and the platform section covered browsers only — a conspicuous omission now the package ships a /server entry. Installation now states the requirement, and that nothing below Node 22 is actually exercised.
• The TypeScript Types list omitted every type added this release — CaptureReport, UtmRejection, UtmRejectionReason, the sanitizer/PII report types, and both server types. It reads as an inventory, so an incomplete one misleads.
• captureUtmParametersWithReport had no API Reference entry, only prose. Added, along with onMaxLength / valuePattern / lowercaseValues in the captureUtmParameters options example.

Test Plan

• npm test — 635 passing
• npm run build — succeeds
• npm run format:check — clean
• README anchor links resolve (#telling-no-campaign-apart-from-campaign-rejected, #server-side-usage)

Merging this brings 0.3.0 and the README fix to main, after which npm run release:patch cuts 0.3.1 with correct docs.