From 50a784dc9dd57399c45bd70fafe1e15128c7330a Mon Sep 17 00:00:00 2001
From: Steven Ciraolo <steve@rankonelabs.com>
Date: Tue, 11 Aug 2026 14:07:31 -0700
Subject: [PATCH 1/2] ci: publish contracts package to npm

---
 .github/workflows/publish-npm.yml | 27 +++++++++++++++++++++++++++
 package.json                      |  2 +-
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/publish-npm.yml

diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
new file mode 100644
index 0000000..20dbc13
--- /dev/null
+++ b/.github/workflows/publish-npm.yml
@@ -0,0 +1,27 @@
+name: Publish npm package
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      - name: Publish package
+        run: npm publish --access public
diff --git a/package.json b/package.json
index 53a76fd..b3eafef 100644
--- a/package.json
+++ b/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "@rankonelabs/paa-contracts",
+  "name": "@paadev/paa-contracts",
   "version": "0.1.0",
   "description": "Published contract artifacts of the Progressive Autonomy Architecture: four normative JSON Schemas, the positive fixture corpus every implementation is checked against, and the table-driven invalid-case matrices.",
   "license": "MIT",

From 4378f1151e3b21784ebf0691b435356f408389cd Mon Sep 17 00:00:00 2001
From: Steven Ciraolo <steve@rankonelabs.com>
Date: Tue, 11 Aug 2026 14:16:12 -0700
Subject: [PATCH 2/2] ci: harden npm trusted publishing

---
 .github/workflows/publish-npm.yml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 20dbc13..c9c7cba 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -14,6 +14,12 @@ jobs:
       contents: read
       id-token: write
     steps:
+      - name: Require the main branch
+        if: github.ref != 'refs/heads/main'
+        run: |
+          echo "Refusing to publish from $GITHUB_REF; dispatch this workflow from main."
+          exit 1
+
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           persist-credentials: false
@@ -21,7 +27,20 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24
-          registry-url: https://registry.npmjs.org
+
+      - name: Configure npm trusted publishing
+        run: |
+          npm install --global npm@12.0.2
+          npm config set registry https://registry.npmjs.org
+
+      - name: Verify package contents and installation
+        run: |
+          npm pack --dry-run --json
+          package_tarball="$(npm pack --pack-destination "$RUNNER_TEMP" --silent)"
+          install_dir="$(mktemp -d)"
+          npm install --ignore-scripts --prefix "$install_dir" "$RUNNER_TEMP/$package_tarball"
+          node -e "const p = require(process.argv[1]); if (p.name !== '@paadev/paa-contracts') process.exit(1)" \
+            "$install_dir/node_modules/@paadev/paa-contracts/package.json"
 
       - name: Publish package
         run: npm publish --access public