From 0b023ad449ce5ad317efabe8b1f88ab066cfe775 Mon Sep 17 00:00:00 2001
From: Josh Owens <joshua.owens@gmail.com>
Date: Fri, 21 Aug 2026 20:05:57 -0400
Subject: [PATCH] ci: update npm for trusted publishing, add OIDC diagnostics,
 npm pkg fix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 0.2.0 publish attempt hit plain ENEEDAUTH with no OIDC exchange traces
— npm never attempted trusted publishing. Upgrade npm to latest before
publish (Node-bundled npm may predate support) and log node/npm versions
plus ACTIONS_ID_TOKEN var presence so the next failure names its own cause.
npm pkg fix applied so npm stops auto-correcting bin/repository at publish
time (its 'correction' threatened to strip the bin entry entirely).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GtAjJabU9hUkrzoWF3Xtzm
---
 .github/workflows/release.yml | 15 +++++++++++++++
 package.json                  |  4 ++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d50986a..a684a3c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,6 +33,21 @@ jobs:
         with:
           node-version: "lts/*"
 
+      # Trusted publishing (OIDC) needs a current npm; the Node-bundled one
+      # may predate support. The diagnostic line makes the next auth failure
+      # self-explaining: no ACTIONS_ID_TOKEN vars → workflow context problem;
+      # vars present but publish ENEEDAUTHs → npmjs.com trusted-publisher
+      # config mismatch (must be repo queso/FlowSpec, workflow release.yml).
+      - name: Update npm for trusted publishing
+        run: |
+          npm install -g npm@latest
+          echo "node=$(node --version) npm=$(npm --version)"
+          if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
+            echo "OIDC vars: present"
+          else
+            echo "OIDC vars: MISSING — id-token permission not reaching this job"
+          fi
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
diff --git a/package.json b/package.json
index 5eceb2e..c07964d 100644
--- a/package.json
+++ b/package.json
@@ -6,14 +6,14 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
-    "flowspec": "./dist/index.js"
+    "flowspec": "dist/index.js"
   },
   "files": [
     "dist"
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/queso/FlowSpec"
+    "url": "git+https://github.com/queso/FlowSpec.git"
   },
   "keywords": [
     "testing",