From 7449492f3a05be2eae7dd3acc5b86f76531c5129 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yusuf=20To=CC=88r?=
 <3296904+yusuftor@users.noreply.github.com>
Date: Tue, 3 Nov 2026 14:15:40 +0100
Subject: [PATCH] Publish to npm with trusted publishing

npm is removing direct publishing with 2FA-bypass tokens in January 2027,
and the stored NPM_TOKEN already fails (E404 on 1.0.17). Publish with
GitHub OIDC instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../workflows/build-test-publish-superscript-npm.yml  | 11 +++++++----
 wasm/package.json                                     |  5 +++++
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-test-publish-superscript-npm.yml b/.github/workflows/build-test-publish-superscript-npm.yml
index bb1d5ad..4cdce68 100644
--- a/.github/workflows/build-test-publish-superscript-npm.yml
+++ b/.github/workflows/build-test-publish-superscript-npm.yml
@@ -8,8 +8,11 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write  
-  packages: write  
+  contents: write
+  packages: write
+  # Lets npm trusted publishing exchange the GitHub OIDC token instead of
+  # using a stored npm token.
+  id-token: write
 
 jobs:
   build-test-publish:
@@ -156,6 +159,8 @@ jobs:
       - name: Publish to NPM
         if: github.event_name == 'push' && github.ref == 'refs/heads/master'
         run: |
+          # Trusted publishing needs npm 11.5.1 or later.
+          npm install -g npm@latest
           cd wasm
           # Try a normal publish first; if it fails (e.g. first-time publish of a
           # scoped package), retry with --access public.
@@ -165,6 +170,4 @@ jobs:
             echo "'npm publish' failed, retrying with --access public..."
             npm publish --access public
           fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
       
\ No newline at end of file
diff --git a/wasm/package.json b/wasm/package.json
index abd2609..07789d5 100644
--- a/wasm/package.json
+++ b/wasm/package.json
@@ -1,6 +1,11 @@
 {
   "name": "@superwall/superscript",
   "version": "1.0.17",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/superwall/superscript.git",
+    "directory": "wasm"
+  },
   "type": "module",
   "main": "./dist/cjs/node.js",
   "module": "./dist/esm/node.js",