From 72fd0bc8aa031b1f65edfa5cc0771487daae7034 Mon Sep 17 00:00:00 2001
From: Mickey Scherrer <5324300+iicky@users.noreply.github.com>
Date: Sun, 5 Apr 2026 22:49:15 -0400
Subject: [PATCH 1/3] fix npm publish: remove registry-url to allow OIDC auth

---
 .github/workflows/node.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/node.yaml b/.github/workflows/node.yaml
index 1e3ff04..a3ae084 100644
--- a/.github/workflows/node.yaml
+++ b/.github/workflows/node.yaml
@@ -132,7 +132,6 @@ jobs:
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "22"
-          registry-url: "https://registry.npmjs.org"
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -148,4 +147,4 @@ jobs:
         run: |
           npm ci --ignore-scripts
           npx napi pre-publish -t npm
-          npm publish --access public --provenance
+          npm publish --access public --provenance --registry https://registry.npmjs.org

From b62ce42cc83f304ddd7b7d0bd57c0c20891a7977 Mon Sep 17 00:00:00 2001
From: Mickey Scherrer <5324300+iicky@users.noreply.github.com>
Date: Sun, 5 Apr 2026 22:54:17 -0400
Subject: [PATCH 2/3] fix npm publish: add NPM_TOKEN for auth

---
 .github/workflows/node.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/node.yaml b/.github/workflows/node.yaml
index a3ae084..8ea18a0 100644
--- a/.github/workflows/node.yaml
+++ b/.github/workflows/node.yaml
@@ -132,6 +132,7 @@ jobs:
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "22"
+          registry-url: "https://registry.npmjs.org"
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -144,7 +145,9 @@ jobs:
 
       - name: Publish
         working-directory: node
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           npm ci --ignore-scripts
           npx napi pre-publish -t npm
-          npm publish --access public --provenance --registry https://registry.npmjs.org
+          npm publish --access public --provenance

From 494eb0575cb8b46797ad1786e8792977fad10a79 Mon Sep 17 00:00:00 2001
From: Mickey Scherrer <5324300+iicky@users.noreply.github.com>
Date: Sun, 5 Apr 2026 22:58:56 -0400
Subject: [PATCH 3/3] bump version to 0.5.8

---
 Cargo.lock             | 4 ++--
 Cargo.toml             | 2 +-
 node/Cargo.toml        | 2 +-
 node/package-lock.json | 4 ++--
 node/package.json      | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 72f7efe..de71815 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1379,7 +1379,7 @@ dependencies = [
 
 [[package]]
 name = "murk-cli"
-version = "0.5.7"
+version = "0.5.8"
 dependencies = [
  "age",
  "assert_cmd",
@@ -1409,7 +1409,7 @@ dependencies = [
 
 [[package]]
 name = "murk-napi"
-version = "0.5.7"
+version = "0.5.8"
 dependencies = [
  "murk-cli",
  "napi",
diff --git a/Cargo.toml b/Cargo.toml
index 677ccfd..8657b8f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ exclude = ["fuzz"]
 
 [package]
 name = "murk-cli"
-version = "0.5.7"
+version = "0.5.8"
 edition = "2024"
 rust-version = "1.89"
 description = "Encrypted secrets manager for developers — one file, age encryption, git-friendly"
diff --git a/node/Cargo.toml b/node/Cargo.toml
index 88690bb..017d7ba 100644
--- a/node/Cargo.toml
+++ b/node/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "murk-napi"
-version = "0.5.7"
+version = "0.5.8"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 publish = false
diff --git a/node/package-lock.json b/node/package-lock.json
index c587d87..f55e829 100644
--- a/node/package-lock.json
+++ b/node/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@iicky/murk-secrets",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@iicky/murk-secrets",
-      "version": "0.5.7",
+      "version": "0.5.8",
       "license": "MIT OR Apache-2.0",
       "devDependencies": {
         "@biomejs/biome": "^2.4.9",
diff --git a/node/package.json b/node/package.json
index b0ed502..8258946 100644
--- a/node/package.json
+++ b/node/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@iicky/murk-secrets",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "description": "Node.js/TypeScript bindings for murk — encrypted secrets manager",
   "main": "index.js",
   "types": "index.d.ts",