Release prep: publish nodeup-npm to npm registry on v1.0.0 cut

[dipto0321]

Tracks the manual npm-publish step for the v1.0.0 cut. The wrapper
itself shipped in #34 (nodeup-npm/ in repo, scripts/check.js +
scripts/install.js, pinned-version design). The npm package name
is nodeupx (not nodeup); see #37.

Pre-publish checklist

• npmjs.com account exists with publish rights on the
  nodeupx package name. The bare nodeup name is owned
  by an unrelated dormant 2015 package (romanmt/nodeup,
  "a simple cluster implementation for node"), so we cannot
  claim it — npm publish fails with
  You do not have permission to publish "nodeup" if you
  try the wrong name.
• 2FA enabled on the npm account, authenticator-app mode (SMS
  and email-only modes are not accepted for publish). Configure
  at https://www.npmjs.com/settings//security.
• v1.0.0 GitHub release exists with all 5 binaries uploaded by
  GoReleaser (linux/darwin/windows × amd64/arm64, minus
  windows/arm64 which is intentionally excluded). The wrapper's
  install.js downloads from
  https://github.com/dipto0321/nodeup/releases/download/v1.0.0/...,
  so this has to land first.
• nodeup-npm/package.json's binaryVersion field is set to
  1.0.0 (already true on main as of chore(release): ship npm wrapper and install-method guidance #34).

Publish flow

cd nodeup-npm
npm pack --dry-run   # expect 5 files: LICENSE, README.md, package.json, scripts/{check,install}.js
npm login            # prompts for username + password + email; then for OTP from your authenticator app
npm publish          # prompts for another OTP from your authenticator

Full details are in docs/release-checklist.md under "Publishing
nodeup-npm to the npm registry".

After the first publish

• Confirm npm view nodeupx shows version 1.0.0 on the
  registry.

• Smoke test: npm install -g nodeupx in a fresh shell,
  then nodeup version. Should print the v1.0.0 build info
  and download a ~6 MB static binary.

• Consider automating future publishes. npmjs.com permanently
  revoked classic tokens on December 9, 2025; there's no
  "Automation" token type anymore. The right options are:
  1. OIDC Trusted Publishing (recommended) — the
  publish-npm job in .github/workflows/release.yml
  already exchanges GitHub's OIDC token for a one-hour
  publish token scoped to nodeupx. The trust entry
  on the npmjs.com side must point at
  release.yml in dipto0321/nodeup. No NPM_TOKEN
  secret, no rotation, no leak surface.
  2. Granular access token — created at
  <https://www.npmjs.com/settings//tokens>, 90-day
  max expiry, package-scoped to nodeupx, optional
  bypass_2fa for unattended CI. Stored as
  gh secret set NPM_TOKEN and consumed in release.yml.

  Don't automate the *first* publish; the manual `npm publish`
  establishes the package on npmjs.com and the OIDC trust
  entry can be registered on the package page right after.
  

Linked

• Closes the "publish npm wrapper" arm of chore(release): finalize GoReleaser config and npm wrapper #17 (the wrapper code
  itself shipped in chore(release): ship npm wrapper and install-method guidance #34).
• npm package name change nodeup → nodeupx documented in
  chore(release): rename npm wrapper to nodeup-cli #37 (the wrapper still installs the binary as nodeup on
  $PATH).
• Blocked on the v1.0.0 GitHub release tag + GoReleaser run.

---

Note

2026-07-04 updates:

• Package renamed nodeup-cli → nodeupx (PR chore(release): rename npm package from nodeup-cli to nodeupx #108). nodeup-cli@1.0.0 was unpublished and the name sat in the 24h unpublish hold, so the wrapper moved to nodeupx (verified unclaimed on the registry). Version/binaryVersion are at 1.0.1 per chore(release): bump nodeup-cli to 1.0.1 with binaryVersion sync and repo URL fix #107.
• Automation decision made: OIDC Trusted Publishing (option 1 above) for every publish after the first. release.yml's publish-npm job is already wired (PR ci(release): add --provenance to npm publish; pin actions to commit SHAs #100); the only remaining registry-side step is registering the trust entry (GitHub Actions / dipto0321/nodeup / release.yml) on https://www.npmjs.com/package/nodeupx/access right after the first manual publish. Flow documented in docs/release-checklist.md (PR docs(release): make OIDC trusted publishing the documented npm flow #109).

[dipto0321]

Heads-up: the npm package name shipped in #37 is nodeup-cli, not nodeup. The bare nodeup name on npmjs.com is owned by an unrelated dormant 2015 package (romanmt/nodeup — "a simple cluster implementation for node"), so we can't claim it. The downloaded binary still installs as the nodeup CLI on $PATH; only the npm package name changed.

Updates the pre-publish checklist in this issue:

• Claim nodeup-cli on npmjs.com (not nodeup)
• npm pack --dry-run from nodeup-npm/ produces nodeup-cli-1.0.0.tgz
• npm install -g nodeup-cli is the user-facing install command

[dipto0321]

Documentation correction: the npm token model I described when I
first opened this issue is stale. npmjs.com permanently revoked
classic tokens on December 9, 2025, and there's no "Automation"
token type anymore. The right options now are:

1. OIDC Trusted Publishing (recommended for our setup) —
   release.yml exchanges GitHub's OIDC token for a one-hour
   publish token scoped to nodeup-cli. Per-package config in
   npm's "Trusted Publisher" UI. No NPM_TOKEN secret, no rotation.
2. Granular access token as NPM_TOKEN — browser-only
   creation at <https://www.npmjs.com/settings//tokens>,
   90-day max expiry, package-scoped, optional bypass_2fa for
   unattended CI. Stored via gh secret set NPM_TOKEN.

The post-tag section of docs/release-checklist.md now reflects
both options (PR #38, just merged). If you're publishing
manually for v1.0.0, you don't need either — npm login (now a
short-lived session token) + npm publish + the OTP from your
authenticator app is enough for the first publish.

Still recommended order for the v1.0.0 cut:

1. Tag v1.0.0 → GoReleaser uploads binaries
2. Flip dipto0321/homebrew-tap and dipto0321/scoop-bucket to public
3. Manual npm publish from nodeup-npm/ (this issue)
4. Wire OIDC Trusted Publishing into release.yml so future
   publishes happen automatically on tag push