fix: publish alpha.3 through npm OIDC (#23)

Author: tensornull

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.1.0-alpha.2"
+  ".": "0.1.0-alpha.3"
 }

CHANGELOG.md

@@ -5,6 +5,16 @@ follows Keep a Changelog, and versions follow Semantic Versioning.
 
 ## [Unreleased]
 
+## [0.1.0-alpha.3] - 2026-07-27
+
+### Fixed
+
+- Accepted the fixed authentication sentinel value injected by
+  `actions/setup-node` for npm Trusted Publishing while continuing to reject
+  real registry token credentials.
+- Replaced the unpublished immutable alpha.2 release after its publication
+  guard failed before invoking npm.
+
 ## [0.1.0-alpha.2] - 2026-07-27
 
 ### Changed

README.md

@@ -5,7 +5,7 @@ the official OpenAI JavaScript request, response, stream, and error types while
 defaulting the client to CometAPI.
 
 > **Registry Alpha pre-release:** the SDK is under active 0.1 development.
-> `0.1.0-alpha.2` is approved for npm publication under the `next` dist-tag,
+> `0.1.0-alpha.3` is approved for npm publication under the `next` dist-tag,
 > and its API may change before `0.1.0`.
 
 ## Supported 0.1 surface
@@ -52,8 +52,8 @@ For source-checkout testing, retain and verify one exact tarball:
 ```bash
 mkdir -p .artifacts
 npm pack --pack-destination .artifacts
-npm run test:package -- --tarball .artifacts/cometapi-0.1.0-alpha.2.tgz
-npm run test:fixtures -- --tarball .artifacts/cometapi-0.1.0-alpha.2.tgz
+npm run test:package -- --tarball .artifacts/cometapi-0.1.0-alpha.3.tgz
+npm run test:fixtures -- --tarball .artifacts/cometapi-0.1.0-alpha.3.tgz
 ```
 
 Install that path in a separate consumer when needed. Do not treat a locally
@@ -210,8 +210,9 @@ parent.
 
 The repository has completed Public Preview. Blocking CI, protected repository
 rules, security reporting, protected environments, and the authorized live
-smoke have passed. Registry Alpha `0.1.0-alpha.1` is available from npm, and
-`0.1.0-alpha.2` is approved for OIDC publication. Mocked responses, packed
+smoke have passed. Registry Alpha `0.1.0-alpha.1` is available from npm. The
+immutable `0.1.0-alpha.2` GitHub release failed before invoking npm, and
+`0.1.0-alpha.3` is approved for OIDC publication. Mocked responses, packed
 artifacts, GitHub Actions, trusted live tests, and npm publication remain
 separate evidence layers and must not be represented as another.
 

RELEASING.md

@@ -9,7 +9,7 @@ Release status is evidence-based:
 | Local code-complete             | Required source, tests, documentation, metadata, fixtures, and workflows exist, and every applicable offline check passes.                                                   |
 | Private Remote Validation ready | Local gates pass, the sanitized history and maintainer-confirmed identity are complete, and real credential-free private default-branch CI passes.                           |
 | Public Preview ready            | After visibility changes, public-only repository rules, security reporting, environments, default-branch CI, the content gate, and authorized protected live smoke all pass. |
-| Registry Alpha candidate        | The exact `0.1.0-alpha.2` artifact passes package and clean-install gates.                                                                                                   |
+| Registry Alpha candidate        | The exact `0.1.0-alpha.3` artifact passes package and clean-install gates after preserving the unpublished immutable alpha.2 failure record.                                 |
 | Registry Alpha released         | The public npm artifact installs from the `next` channel, passes post-publication verification, and has verified provenance plus any documented one-time bootstrap evidence. |
 | Stable released                 | Every stable 0.1.0 local, remote, live, review, provenance, and registry gate has recorded evidence.                                                                         |
 
@@ -337,11 +337,17 @@ one-time exception:
    publication; the bootstrap does not change or defer that requirement.
 5. A maintainer immediately configures OIDC, removes the environment variable
    and secret, revokes the token, and restricts token-based publishing.
-6. The project immediately prepares and publishes `0.1.0-alpha.2` through
-   OIDC, verifies its provenance and public installation, and confirms that
-   `next` resolves to `0.1.0-alpha.2`.
-7. The release record documents the exception and both public-install evidence
-   layers.
+6. The project prepared the immutable `0.1.0-alpha.2` GitHub release through
+   OIDC. Exact-artifact verification and the protected live smoke passed, but
+   the local publication guard rejected the fixed `actions/setup-node`
+   authentication placeholder before npm was invoked. No alpha.2 registry
+   artifact was published.
+7. Preserve that immutable failure record, prepare and publish
+   `0.1.0-alpha.3` through OIDC with regression coverage for the placeholder,
+   verify its provenance and public installation, and confirm that `next`
+   resolves to `0.1.0-alpha.3`.
+8. The release record documents the exception, the unpublished alpha.2
+   attempt, and both public-install evidence layers.
 
 This exception must never become a reusable source-controlled publishing path.
 

ROADMAP.md

@@ -15,8 +15,11 @@ Private Remote Validation and Public Preview are complete for the sanitized
 repository. The repository is public with blocking CI, protected repository and
 tag rules, Private Vulnerability Reporting, protected environments, and
 authorized live-smoke evidence. The functional `0.1.0-alpha.1` prerelease is
-available from npm; Registry Alpha remains open until `0.1.0-alpha.2` completes
-the OIDC, provenance, ownership, and public-install verification sequence.
+available from npm. The immutable `0.1.0-alpha.2` GitHub release failed locally
+before invoking npm because its publication guard rejected the fixed
+`actions/setup-node` authentication placeholder. Registry Alpha remains open
+until `0.1.0-alpha.3` completes the OIDC, provenance, ownership, and
+public-install verification sequence.
 
 ## Milestones
 
@@ -25,7 +28,7 @@ the OIDC, provenance, ownership, and public-install verification sequence.
 | Repository foundation      | In progress | The repository has reproducible development, contribution, security, and release processes.                                              |
 | Private Remote Validation  | Complete    | The sanitized private repository passes real credential-free default-branch CI; public-only controls and live tests remain disabled.     |
 | Public Preview             | Complete    | The public repository has blocking CI, repository rules, security reporting, protected environments, and authorized live-smoke evidence. |
-| 0.1.x Registry Alpha       | In progress | Early adopters can install a functional prerelease from npm's `next` channel; alpha.2 must prove the OIDC-only publication path.         |
+| 0.1.x Registry Alpha       | In progress | Early adopters can install a functional prerelease from npm's `next` channel; alpha.3 must prove the OIDC-only publication path.         |
 | 0.1.0 Stable               | Planned     | Users can install a fully verified package from npm's default channel.                                                                   |
 | 0.2.0 provider-native text | Planned     | Users can opt into Anthropic Messages and Gemini text adapters through isolated subpath exports.                                         |
 | 0.3.0 CometAPI resources   | Planned     | Users receive typed access to the first stable CometAPI-specific account or platform resources.                                          |
@@ -339,9 +342,15 @@ npm does not allow configuration before the first package publication, only
    access and provenance, and verifies registry installation.
 4. A maintainer immediately configures Trusted Publishing, removes the variable
    and secret, revokes the token, and restricts token-based publishing.
-5. The project immediately publishes `0.1.0-alpha.2` through OIDC, verifies its
-   provenance and installation, and confirms that `next` resolves to
-   `0.1.0-alpha.2`.
+5. The project attempted to publish `0.1.0-alpha.2` through OIDC. Its immutable
+   GitHub release passed exact-artifact and live-smoke verification, but the
+   local publication guard rejected the fixed `actions/setup-node`
+   authentication placeholder before npm was invoked; no alpha.2 registry
+   artifact exists.
+6. The project preserves that immutable failure record, publishes
+   `0.1.0-alpha.3` through OIDC with regression coverage for the placeholder,
+   verifies provenance and installation, and confirms that `next` resolves to
+   `0.1.0-alpha.3`.
 
 This exception must be recorded in the release evidence and must never become
 a reusable publication path.

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "cometapi",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "description": "Official TypeScript and Node.js client for the CometAPI OpenAI-compatible API",
   "author": "CometAPI",
   "license": "MIT",

package.json

@@ -7,7 +7,11 @@ set -euo pipefail
 
 artifact_directory="${ARTIFACT_DIRECTORY:-release-artifacts}"
 
-if [[ -n "${NODE_AUTH_TOKEN:-}" || -n "${NPM_TOKEN:-}" ]]; then
+# actions/setup-node exports this fixed sentinel when registry-url is configured,
+# including the npm-documented Trusted Publishing workflow.
+setup_node_auth_placeholder="XXXXX-XXXXX-XXXXX-XXXXX"
+if [[ -n "${NPM_TOKEN:-}" ]] || \
+  [[ -n "${NODE_AUTH_TOKEN:-}" && "${NODE_AUTH_TOKEN}" != "$setup_node_auth_placeholder" ]]; then
   echo "Registry tokens are forbidden; publication must use npm Trusted Publishing." >&2
   exit 1
 fi

scripts/publish-artifact.sh

@@ -18,6 +18,7 @@ import { afterEach, describe, expect, it } from "vitest";
 const script = fileURLToPath(
   new URL("../scripts/publish-artifact.sh", import.meta.url),
 );
+const setupNodeAuthPlaceholder = "XXXXX-XXXXX-XXXXX-XXXXX";
 const temporaryDirectories = [];
 
 afterEach(() => {
@@ -62,7 +63,7 @@ function runPublish({
   distTag = "next",
   nodeAuthToken = "",
   npmToken = "",
-  version = "0.1.0-alpha.2",
+  version = "0.1.0-alpha.3",
 } = {}) {
   const { bin, log, root } = fixture();
   const result = spawnSync("bash", [script], {
@@ -96,6 +97,16 @@ describe("publish artifact authentication", () => {
     );
   });
 
+  it("allows the actions/setup-node authentication placeholder", () => {
+    const { log, result } = runPublish({
+      nodeAuthToken: setupNodeAuthPlaceholder,
+    });
+    expect(result.status, result.stderr).toBe(0);
+    expect(log).toMatch(
+      /^token-present\npublish .* --provenance --tag next\n$/,
+    );
+  });
+
   it.each([
     ["NODE_AUTH_TOKEN", { nodeAuthToken: "opaque" }],
     ["NPM_TOKEN", { npmToken: "opaque" }],