fix: publish through npx npm@11 with an explicit dist-tag

.github/workflows/publish.yml

@@ -24,14 +24,14 @@ jobs:
         uses: silverhand-io/actions-node-pnpm-run-steps@v5
         with:
           pnpm-version: 10.34.5
-          # Node 24, not 22: `pnpm publish` delegates the actual publish to the npm CLI,
-          # and npm's OIDC trusted publishing requires npm >= 11.5.1 — bundled with
-          # Node 24, while Node 22 still ships npm 10.x.
-          node-version: 24
+          node-version: 22
 
       # Authenticates via OIDC trusted publishing (configured on npmjs.com for this
       # package: repository mcp-auth/js, workflow publish.yml) — no npm token involved.
-      # Requires the `id-token: write` permission above.
+      # Runs through `npx npm@11` because npm's OIDC support requires npm >= 11.5.1,
+      # while `pnpm publish` delegates to the npm bundled with Node (10.x on Node 22).
+      # npm 11 also requires an explicit --tag for prerelease versions; this package
+      # deliberately publishes betas to `latest` (the ecosystem default is MCP SDK v2).
       - name: Publish to npm
         working-directory: packages/mcp-auth
-        run: pnpm publish --provenance --no-git-checks
+        run: npx --yes npm@11 publish --tag latest --provenance

packages/mcp-auth/package.json

@@ -28,7 +28,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/mcp-auth/js.git",
+    "url": "git+https://github.com/mcp-auth/js.git",
     "directory": "packages/mcp-auth"
   },
   "scripts": {