feat: add npm publish script with workspace:* → ^version replacement

Publishes 5 packages in dependency order: canon → signer → verifier → visualizer → attest-zk-groth16.
Replaces workspace:* with ^x.y.z in dependencies before each publish, restores after.
Reference: lemmaoracle/lemma/scripts/publish-npm.sh

Author: Lemma Daily Lint

scripts/publish-npm.sh

@@ -0,0 +1,136 @@
+#!/bin/bash
+# Publish Verifiable OKF packages to npm
+# Usage:
+#   ./scripts/publish-npm.sh [version]
+#
+#   version: patch (default) | minor | major | specific version (e.g. 0.1.1)
+#
+# Publish order (dependency graph): canon → signer → verifier → visualizer → attest-zk-groth16
+
+set -e
+
+ALL_PACKAGES=("canon" "signer" "verifier" "visualizer" "attest-zk-groth16")
+NPM_SCOPE="@verifiable-okf"
+
+VERSION="${1:-patch}"
+
+echo "🚀 Publishing $NPM_SCOPE/* to npm"
+echo "Version: $VERSION"
+
+# Check npm login
+if ! npm whoami &> /dev/null; then
+    echo "❌ Not logged into npm. Run 'npm login' first."
+    exit 1
+fi
+
+# Must run from repo root
+if [ ! -f "package.json" ]; then
+    echo "❌ Run from repository root"
+    exit 1
+fi
+
+# Build all packages
+echo "📦 Building all packages..."
+pnpm -F "./packages/*" build
+
+# ── canon (leaf — no workspace deps) ──
+publish_canon() {
+    cd packages/canon
+    npm version "$VERSION" --no-git-tag-version
+    local ver=$(node -p "require('./package.json').version")
+    echo "🚀 Publishing $NPM_SCOPE/canon@$ver..."
+    npm publish --access public
+    cd ../..
+    echo "✅ $NPM_SCOPE/canon@$ver"
+}
+
+# ── signer (depends on canon) ──
+publish_signer() {
+    cd packages/signer
+    npm version "$VERSION" --no-git-tag-version
+    cp package.json package.json.backup
+
+    local canon_ver=$(node -p "require('../canon/package.json').version")
+    node -e "
+const pkg = require('./package.json');
+pkg.dependencies['$NPM_SCOPE/canon'] = '^${canon_ver}';
+require('fs').writeFileSync('./package.json', JSON.stringify(pkg, null, 2) + '\n');
+"
+    local ver=$(node -p "require('./package.json').version")
+    echo "🚀 Publishing $NPM_SCOPE/signer@$ver (canon: ^$canon_ver)..."
+    npm publish --access public
+    mv package.json.backup package.json
+    cd ../..
+    echo "✅ $NPM_SCOPE/signer@$ver"
+}
+
+# ── verifier (depends on canon) ──
+publish_verifier() {
+    cd packages/verifier
+    npm version "$VERSION" --no-git-tag-version
+    cp package.json package.json.backup
+
+    local canon_ver=$(node -p "require('../canon/package.json').version")
+    node -e "
+const pkg = require('./package.json');
+pkg.dependencies['$NPM_SCOPE/canon'] = '^${canon_ver}';
+require('fs').writeFileSync('./package.json', JSON.stringify(pkg, null, 2) + '\n');
+"
+    local ver=$(node -p "require('./package.json').version")
+    echo "🚀 Publishing $NPM_SCOPE/verifier@$ver (canon: ^$canon_ver)..."
+    npm publish --access public
+    mv package.json.backup package.json
+    cd ../..
+    echo "✅ $NPM_SCOPE/verifier@$ver"
+}
+
+# ── visualizer (depends on canon + verifier) ──
+publish_visualizer() {
+    cd packages/visualizer
+    npm version "$VERSION" --no-git-tag-version
+    cp package.json package.json.backup
+
+    local canon_ver=$(node -p "require('../canon/package.json').version")
+    local verifier_ver=$(node -p "require('../verifier/package.json').version")
+    node -e "
+const pkg = require('./package.json');
+pkg.dependencies['$NPM_SCOPE/canon'] = '^${canon_ver}';
+pkg.dependencies['$NPM_SCOPE/verifier'] = '^${verifier_ver}';
+require('fs').writeFileSync('./package.json', JSON.stringify(pkg, null, 2) + '\n');
+"
+    local ver=$(node -p "require('./package.json').version")
+    echo "🚀 Publishing $NPM_SCOPE/visualizer@$ver (canon: ^$canon_ver, verifier: ^$verifier_ver)..."
+    npm publish --access public
+    mv package.json.backup package.json
+    cd ../..
+    echo "✅ $NPM_SCOPE/visualizer@$ver"
+}
+
+# ── attest-zk-groth16 (leaf — only external @lemmaoracle/sdk dep) ──
+publish_attest() {
+    cd packages/attest-zk-groth16
+    npm version "$VERSION" --no-git-tag-version
+    local ver=$(node -p "require('./package.json').version")
+    echo "🚀 Publishing $NPM_SCOPE/attest-zk-groth16@$ver..."
+    npm publish --access public
+    cd ../..
+    echo "✅ $NPM_SCOPE/attest-zk-groth16@$ver"
+}
+
+# ── Execute in dependency order ──
+publish_canon
+publish_signer
+publish_verifier
+publish_visualizer
+publish_attest
+
+echo ""
+echo "📋 Published:"
+for pkg in "${ALL_PACKAGES[@]}"; do
+    local_ver=$(node -p "require('./packages/$pkg/package.json').version")
+    echo "  - $NPM_SCOPE/$pkg@$local_ver"
+done
+echo ""
+echo "⚠️  Version bumps applied to all package.json files."
+echo "   Commit them after verifying: git diff packages/*/package.json"
+echo "✅ Done!"