ci: npm@latest for trusted publishing + OIDC diagnostics + npm pkg fix

.github/workflows/release.yml

@@ -33,6 +33,21 @@ jobs:
         with:
           node-version: "lts/*"
 
+      # Trusted publishing (OIDC) needs a current npm; the Node-bundled one
+      # may predate support. The diagnostic line makes the next auth failure
+      # self-explaining: no ACTIONS_ID_TOKEN vars → workflow context problem;
+      # vars present but publish ENEEDAUTHs → npmjs.com trusted-publisher
+      # config mismatch (must be repo queso/FlowSpec, workflow release.yml).
+      - name: Update npm for trusted publishing
+        run: |
+          npm install -g npm@latest
+          echo "node=$(node --version) npm=$(npm --version)"
+          if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
+            echo "OIDC vars: present"
+          else
+            echo "OIDC vars: MISSING — id-token permission not reaching this job"
+          fi
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 

package.json

@@ -6,14 +6,14 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
-    "flowspec": "./dist/index.js"
+    "flowspec": "dist/index.js"
   },
   "files": [
     "dist"
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/queso/FlowSpec"
+    "url": "git+https://github.com/queso/FlowSpec.git"
   },
   "keywords": [
     "testing",