Publish a Node package to npm with OIDC trusted publishing

Tag-triggered GitHub Actions publish authenticated by OIDC. Verify npm CLI ≥11.5.1 and Node ≥22.14.0, supported cloud-hosted runners, and matching repository identity. Automatic provenance applies to public packages published from public repositories through supported providers. Use the verified package scope.

Bootstrap order — the package must exist first

npm OIDC and npm trust cannot create a brand-new package. Until the name exists on the registry, OIDC npm publish and POST /-/package/<pkg>/trust both return E404 ... you do not have permission (anti name-hijack). So the first publish is manual:

1. npm run build && npm publish --access public — once, locally, with npm login (handles 2FA/OTP). Creates the package.
2. npm trust github <pkg> --allow-publish --repo <owner/repo> --file npm-publish.yml — grants the workflow publish rights (npm v11+, 2FA required).
3. Validate the new trusted publisher with a successful publish within its two-day activation window. Push the intended release tag only within the authorized release flow.

Prefer OIDC after bootstrap. If token authentication is required, use current granular token permissions and expiry, not removed classic automation tokens. Choose direct publishing or staged publishing explicitly. Current npm policy schedules removal of direct publishing with bypass-2FA tokens in January 2027; verify the current policy before setting up a pipeline.

package.json