fix: switch to npm trusted publishing (OIDC) and fix yarn publish bug

[vorflux]

Summary

Fixes npm publishing which has been failing on every release since v4.18.0, and switches to npm trusted publishing (OIDC) to remove the dependency on NPM_TOKEN secrets.

Root cause (original bug)

bin/publish-npm used yarn publish --tag "$TAG" which targets registry.yarnpkg.com. The Yarn registry is a read-only proxy of npm -- it serves package reads but cannot accept publishes. Every release failed with:

error Couldn't publish package: "https://registry.yarnpkg.com/supermemory: Not found"

Changes

bin/publish-npm:

• Changed yarn publish --tag "$TAG" to npm publish --tag "$TAG" --provenance
• Removed npm config set auth token setup (OIDC handles auth)

.github/workflows/publish-npm.yml:

• Added id-token: write permission for OIDC
• Added node-version: '24' and registry-url: 'https://registry.npmjs.org' to setup-node
• Removed NPM_TOKEN env var from publish step (OIDC handles auth)

npm trusted publishing setup required

Configure trusted publisher on npmjs.com for both packages:

Package	Repository	Workflow	Environment
supermemory	supermemoryai/sdk-ts	publish-npm.yml	(blank)
@supermemory/mcp-server	supermemoryai/sdk-ts	publish-npm.yml	(blank)

Testing

This is a shell script fix + workflow update. The fix will be verified on the next release when the publish workflow runs successfully.

---

Session Details

• Session: View Session
• Requested by: Dhravya Shah (dhravya@supermemory.com)
• Address comments on this PR. Add (aside) to your comment to have me ignore it.