Publish TypeScript package to npmjs

Author: terion-name

.github/workflows/release.yml

@@ -6,13 +6,14 @@ on:
       - '[0-9]*.[0-9]*.[0-9]*'
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
 
 jobs:
   release:
     name: Build and publish release artifacts
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - name: Check out repository
@@ -126,17 +127,19 @@ jobs:
     name: Publish TypeScript package
     runs-on: ubuntu-latest
     needs: release
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
 
-      - name: Set up Node.js for GitHub Packages
+      - name: Set up Node.js for npmjs
         uses: actions/setup-node@v4
         with:
           node-version: '24'
-          registry-url: https://npm.pkg.github.com
-          scope: '@terion-name'
+          registry-url: https://registry.npmjs.org
           cache: npm
           cache-dependency-path: packages/ts/package-lock.json
 
@@ -152,12 +155,11 @@ jobs:
         id: npm_version
         working-directory: packages/ts
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG_NAME: ${{ github.ref_name }}
         run: |
           set -euo pipefail
           package_name="$(node -p "require('./package.json').name")"
-          if npm view "${package_name}@${TAG_NAME}" version --registry=https://npm.pkg.github.com >/dev/null 2>&1; then
+          if npm view "${package_name}@${TAG_NAME}" version --registry=https://registry.npmjs.org >/dev/null 2>&1; then
             echo "exists=true" >> "${GITHUB_OUTPUT}"
             echo "${package_name}@${TAG_NAME} already exists; skipping publish."
           else
@@ -171,17 +173,18 @@ jobs:
           TAG_NAME: ${{ github.ref_name }}
         run: npm version "${TAG_NAME}" --no-git-tag-version
 
-      - name: Publish TypeScript package to GitHub Packages
+      - name: Publish TypeScript package to npmjs
         if: steps.npm_version.outputs.exists != 'true'
         working-directory: packages/ts
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npm publish
+        run: npm publish --access public --registry=https://registry.npmjs.org
 
   docker-images:
     name: Build and publish ${{ matrix.app }} image
     runs-on: ubuntu-latest
     needs: release
+    permissions:
+      contents: read
+      packages: write
     strategy:
       fail-fast: false
       matrix:

README.md

@@ -116,24 +116,10 @@ The smoke tests (`make smoke`) automatically verify that signed `GET`/`HEAD` req
 
 To allow users to download files, your backend application must generate an **edge signed URL**. These use a standard HMAC signature. Since the gateway verifies the signature before generating a ticket, bogus requests are dropped at the edge—saving your private network from dealing with malicious traffic.
 
-We provide drop-in packages for Go, TypeScript, and Python under the `packages/` directory. The TypeScript package is published to GitHub Packages as the public package `@terion-name/air3-edgesign`. Configure npm for the GitHub Packages scope before installing:
+We provide drop-in packages for Go, TypeScript, and Python under the `packages/` directory. The TypeScript package is published to the public npm registry as `@terion/air3-edgesign`:
 
 ```sh
-# One-time user config; alternatively put this line in your project .npmrc.
-npm config set @terion-name:registry https://npm.pkg.github.com
-
-# GitHub's npm registry may require auth for install/metadata access even
-# when package visibility is public. Use a classic PAT with read:packages.
-npm login --scope=@terion-name --registry=https://npm.pkg.github.com
-
-npm install @terion-name/air3-edgesign
-```
-
-For CI, set `NODE_AUTH_TOKEN` (for example from `${GITHUB_TOKEN}` in GitHub Actions, or another token with package read access) and add a project `.npmrc` like:
-
-```ini
-@terion-name:registry=https://npm.pkg.github.com
-//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}
+npm install @terion/air3-edgesign
 ```
 
 ### Go Example
@@ -153,7 +139,7 @@ raw, err := edgesign.SignURL(edgesign.SignInput{
 ### TypeScript Example
 
 ```ts
-import { signUrl, verifyUrl } from '@terion-name/air3-edgesign';
+import { signUrl, verifyUrl } from '@terion/air3-edgesign';
 
 const raw = signUrl({
   method: 'GET',
@@ -203,7 +189,7 @@ go test ./... -race  # run race-enabled Go tests
 
 ## Releases & Docker Images
 
-We publish multi-architecture Docker images (Linux on `amd64` and `arm64`) to the GitHub Container Registry on every release. Cross-compiled binaries for macOS, Windows, and Linux are also attached to GitHub releases. The same tag workflow publishes the public npm package `@terion-name/air3-edgesign` to GitHub Packages with the tag as the npm version. GitHub's npm registry can require a token for install and metadata requests even when a package is public; use the `@terion-name` registry and authentication setup shown above before running `npm install @terion-name/air3-edgesign`.
+We publish multi-architecture Docker images (Linux on `amd64` and `arm64`) to the GitHub Container Registry on every release. Cross-compiled binaries for macOS, Windows, and Linux are also attached to GitHub releases. The same tag workflow publishes the public npm package `@terion/air3-edgesign` to npmjs with the tag as the npm version. Publishing uses npm Trusted Publishing from `.github/workflows/release.yml`, so the GitHub Actions job authenticates to npm through OIDC instead of an npm token.
 
 - `ghcr.io/terion-name/air3/edge-gateway:<tag>`
 - `ghcr.io/terion-name/air3/private-connector:<tag>`

packages/ts/README.md

@@ -1,28 +1,15 @@
-# @terion-name/air3-edgesign
+# @terion/air3-edgesign
 
 TypeScript helpers for signing and verifying air3 edge gateway URLs.
 
-This package is published publicly to GitHub Packages as `@terion-name/air3-edgesign`. Configure npm for the `@terion-name` scope, authenticate if GitHub's npm registry requires it, then install:
+This package is published publicly to npmjs as `@terion/air3-edgesign`:
 
 ```sh
-# One-time user config; alternatively put this line in your project .npmrc.
-npm config set @terion-name:registry https://npm.pkg.github.com
-
-# Use a classic PAT with read:packages when prompted.
-npm login --scope=@terion-name --registry=https://npm.pkg.github.com
-
-npm install @terion-name/air3-edgesign
-```
-
-For CI, set `NODE_AUTH_TOKEN` (for example from `${GITHUB_TOKEN}` in GitHub Actions, or another token with package read access) and add a project `.npmrc` like:
-
-```ini
-@terion-name:registry=https://npm.pkg.github.com
-//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}
+npm install @terion/air3-edgesign
 ```
 
 ```ts
-import { signUrl, verifyUrl } from '@terion-name/air3-edgesign';
+import { signUrl, verifyUrl } from '@terion/air3-edgesign';
 ```
 
-This package is published to GitHub Packages by the tag release workflow. The published runtime entry point is built JavaScript in `dist/` with TypeScript declarations.
+This package is published by the tag release workflow using npm Trusted Publishing from `.github/workflows/release.yml`. The GitHub Actions job authenticates to npm through OIDC instead of an npm token. The published runtime entry point is built JavaScript in `dist/` with TypeScript declarations.

packages/ts/package-lock.json

@@ -5,7 +5,8 @@
   "description": "TypeScript helpers for signing and verifying air3 edge gateway URLs.",
   "license": "MIT",
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
   },
   "type": "module",
   "main": "./dist/index.js",
@@ -36,4 +37,4 @@
     "@types/node": "^24.0.0",
     "typescript": "^5.8.0"
   }
-}
+}