jascal · jascal · Jun 3, 2026 · Jun 3, 2026 · Jun 3, 2026 · Jun 3, 2026
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -18,6 +18,10 @@ jobs:
     name: Publish orca (npm)
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
+    # OIDC trusted publishing — no NPM_TOKEN; npm verifies the GitHub Actions identity
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -28,7 +32,7 @@ jobs:
 
       - uses: pnpm/action-setup@v4
         with:
-          version: 9
+          version: 10.33.0  # >= 10.18 required for pnpm OIDC trusted publishing (paired with id-token: write above)
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -47,14 +51,15 @@ jobs:
             pnpm publish --access public --no-git-checks
           fi
         working-directory: packages/orca-lang
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   # ── npm: @orca-lang/orca-runtime-ts ─────────────────────────────────────────
   publish-npm-runtime-ts:
     name: Publish @orca-lang/orca-runtime-ts (npm)
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -65,7 +70,7 @@ jobs:
 
       - uses: pnpm/action-setup@v4
         with:
-          version: 9
+          version: 10.33.0  # >= 10.18 required for pnpm OIDC trusted publishing (paired with id-token: write above)
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -84,15 +89,16 @@ jobs:
             pnpm publish --access public --no-git-checks
           fi
         working-directory: packages/runtime-ts
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   # ── npm: @orca-lang/orca-mcp-server ─────────────────────────────────────────
   publish-npm-mcp-server:
     name: Publish @orca-lang/orca-mcp-server (npm)
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     needs: publish-npm-orca
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -103,7 +109,7 @@ jobs:
 
       - uses: pnpm/action-setup@v4
         with:
-          version: 9
+          version: 10.33.0  # >= 10.18 required for pnpm OIDC trusted publishing (paired with id-token: write above)
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -126,8 +132,6 @@ jobs:
             # Publish from monorepo root so pnpm can rewrite workspace:* to actual versions
             pnpm publish --filter @orcalang/orca-mcp-server --access public --no-git-checks
           fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   # ── PyPI: orca-runtime-python ────────────────────────────────────────────────
   publish-pypi:
@@ -207,7 +211,7 @@ jobs:
         run: ./mcp-publisher login github-oidc
 
       - name: Publish to MCP Registry
-        run: ./mcp-publisher publish --npm-token=${{ secrets.NPM_TOKEN }}
+        run: ./mcp-publisher publish
 
   # ── GitHub Release notes ─────────────────────────────────────────────────────
   create-release:

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,16 @@ This project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [v0.1.30] — 2026-06-02
+
+### Changed
+
+- **CI / release**: npm publishing for `@orcalang/orca-lang`, `@orcalang/orca-runtime-ts`, and `@orcalang/orca-mcp-server` migrated from a long-lived `NPM_TOKEN` to **OIDC trusted publishing**. There is no stored npm credential anymore, and publishes now carry provenance attestations. `release.yml` gains `id-token: write` on the three npm jobs, pins `pnpm/action-setup` to `10.33.0` (OIDC publish support requires pnpm ≥ 10.18), and drops `NODE_AUTH_TOKEN`. The MCP-registry publish is token-less as well (npm ownership is verified via the published `mcpName` field). Added a `repository` field to the three npm `package.json` files, required for provenance.
+
+No functional or library changes — the train is version-bumped to stay in lockstep.
+
+---
+
 ## [v0.1.29] — 2026-06-02
 
 ### Fixed

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -111,9 +111,9 @@ Releases are **git-tag driven** + **changesets**, mostly automated via `.github/
 
 - **The CI-pushed tag does NOT trigger `release.yml`.** CI pushes the tag with `GITHUB_TOKEN`, which by design cannot trigger another workflow. After CI tags `vX.Y.Z`, **re-push the tag under a real account** to fire the release: `git push origin :refs/tags/vX.Y.Z && git push origin vX.Y.Z`.
 
-- **What `release.yml` (`on: push: tags: v*`) publishes:** npm × 3 (`NPM_TOKEN`), PyPI `orca-runtime-python` (`PYPI_TOKEN`), the Go module (just force-pushes `packages/runtime-go/vX.Y.Z` — proxy.golang.org serves it from the tag, **no token**), MCP Registry, and a GitHub Release. Jobs are idempotent (skip if the version already exists), so re-running is safe.
+- **What `release.yml` (`on: push: tags: v*`) publishes:** npm × 3 (**OIDC trusted publishing** — no token; each npm job has `id-token: write` and publishes via `pnpm publish` on pnpm ≥ 10.18), PyPI `orca-runtime-python` (`PYPI_TOKEN`), the Go module (just force-pushes `packages/runtime-go/vX.Y.Z` — proxy.golang.org serves it from the tag, **no token**), MCP Registry (also token-less — verifies npm ownership via the published `mcpName` field), and a GitHub Release. Jobs are idempotent (skip if the version already exists), so re-running is safe.
 
-- **npm publishing is currently broken** (as of 2026-06): `NPM_TOKEN` is invalid/expired → `Publish` fails with **`E404` on `PUT`** and npm `latest` is stuck at **0.1.27** (0.1.28/0.1.29 published to PyPI + Go but never npm). An E404 on npm publish means the **token**, not the code. Fix is maintainer-only: rotate the `NPM_TOKEN` repo secret, then `gh run rerun <release-run-id> --failed` (re-runs npm + mcp-server + MCP-registry + GitHub-Release jobs).
+- **npm uses OIDC trusted publishing** (since 2026-06, replacing the long-lived `NPM_TOKEN`). *Why:* npm removed classic/automation tokens (Dec 2025) and caps granular write tokens at ≤ 90 days; an expired token broke the 0.1.29 npm publish with **`E404` on `PUT`** (an E404/E403 on npm publish is always the **token/permissions**, never the code). *Setup, if it ever needs redoing:* each npm package needs a **Trusted Publisher** on npmjs.com (package → Settings → Trusted Publisher → GitHub Actions; org=`jascal`, repo=`orca-lang`, workflow=`release.yml`, allowed action `npm publish`), a `repository` field in its `package.json` (for provenance), and `pnpm/action-setup` ≥ 10.18 in the workflow. *Rollback:* the `NPM_TOKEN` secret is retained — to revert, re-add `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` to the three `Publish` steps. npm `latest` is at **0.1.29**.
 
 ## Package Details
 

diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json
@@ -2,6 +2,11 @@
   "name": "@orcalang/orca-mcp-server",
   "version": "0.1.29",
   "description": "LLM agents can now build verified state machines. Generate, parse, verify, and compile Orca state machines from natural language specs — topology guarantees before any code runs.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jascal/orca-lang.git",
+    "directory": "packages/mcp-server"
+  },
   "type": "module",
   "main": "dist/server.js",
   "bin": {

diff --git a/packages/orca-lang/package.json b/packages/orca-lang/package.json
@@ -2,6 +2,11 @@
   "name": "@orcalang/orca-lang",
   "version": "0.1.29",
   "description": "Orca (Orchestrated State Machine Language) - an LLM-native code generation target",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jascal/orca-lang.git",
+    "directory": "packages/orca-lang"
+  },
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

diff --git a/packages/runtime-python/orca_runtime_python/__init__.py b/packages/runtime-python/orca_runtime_python/__init__.py
@@ -46,7 +46,7 @@
 
 from .logging import LogSink, FileSink, ConsoleSink, MultiSink
 
-__version__ = "0.1.29"
+__version__ = "0.1.30"
 
 __all__ = [
     # Types

diff --git a/packages/runtime-ts/package.json b/packages/runtime-ts/package.json
@@ -2,6 +2,11 @@
   "name": "@orcalang/orca-runtime-ts",
   "version": "0.1.29",
   "description": "TypeScript async runtime for Orca state machines",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jascal/orca-lang.git",
+    "directory": "packages/runtime-ts"
+  },
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",