From 2a494b8da3a625d149f075fdcd706d48ec1688e9 Mon Sep 17 00:00:00 2001
From: Omni <omni@numbersprotocol.io>
Date: Mon, 4 May 2026 08:50:17 +0000
Subject: [PATCH] ci: publish npm package with trusted publishing

by Olga Shen & Omni
---
 .github/workflows/release.yml     |  7 ++++---
 .omni/71327bb3-greeting/memory.md | 24 ++++++++++++++++++++++++
 2 files changed, 28 insertions(+), 3 deletions(-)
 create mode 100644 .omni/71327bb3-greeting/memory.md

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8defd7c..bbc62bb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -53,6 +53,9 @@ jobs:
     name: Publish to npm
     needs: validate
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     defaults:
       run:
         working-directory: ts
@@ -62,7 +65,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
           cache: "npm"
           cache-dependency-path: ts/package-lock.json
@@ -75,8 +78,6 @@ jobs:
 
       - name: Publish to npm
         run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   # Publish Python to PyPI
   publish-pypi:
diff --git a/.omni/71327bb3-greeting/memory.md b/.omni/71327bb3-greeting/memory.md
new file mode 100644
index 0000000..f7193c6
--- /dev/null
+++ b/.omni/71327bb3-greeting/memory.md
@@ -0,0 +1,24 @@
+# Workspace Context
+
+<!-- This file is auto-maintained. The Repositories section is refreshed -->
+<!-- by the system. The AI should maintain Environment & Key Discoveries. -->
+
+**Workspace root (absolute path):** `/home/workspaces/conversations/71327bb3-03fd-4337-b47f-6e35487a6803`
+
+## Repositories
+
+- **`capture-sdk/`** — Branch: `omni/71327bb3/capture-sdk`, Remote: `numbersprotocol/capture-sdk`
+  - Official SDKs for [Numbers Protocol](https://numbersprotocol.io/) Capture API. Register digital assets with blockchain-backed provenance.
+  - Has `CLAUDE.md` project instructions
+
+## Environment & Tools
+
+- Release workflow: `.github/workflows/release.yml` publishes npm package `@numbersprotocol/capture-sdk` from `ts/` and PyPI package from `python/` on `v*` tags.
+- npm publishing uses GitHub Actions trusted publishing/OIDC with Node.js 24; no `NPM_TOKEN` is required for npm publish.
+
+## Key Discoveries
+
+- TypeScript package `ts/package.json` repository URL is `git+https://github.com/numbersprotocol/capture-sdk.git` with `directory: "ts"`, matching npm trusted publisher requirements for the GitHub repo.
+
+---
+_Last system refresh: 2026-05-04 08:48 UTC_