v0.4.2 — fix npm publish (OIDC + README)
Patch Release — npm publish unblocked
Root cause for v0.4.1 publish ENEEDAUTH
setup-node@v4 with NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} (unset) wrote an empty _authToken= line into .npmrc, making npm think auth was configured but invalid. The OIDC trusted-publisher (configured on npmjs.com) couldn't take over because the empty token blocked the fallback.
Also: node 22 ships npm 10.x which doesn't reliably support OIDC publishing. Node 24 ships npm 11.5.1+ which does.
Fixes
- Workflow upgraded to node 24
- Removed
NODE_AUTH_TOKENenv entirely — OIDC trusted publisher handles auth package.jsonfilesarray now explicitly includesREADME.md,CHANGELOG.md,LICENSE(v0.2.0 on npm shows 'no README' because of the allowlist)- Documented all of this in
CLAUDE.md
See CHANGELOG.md.