From c34e30210a41c1defe307f8dc72809dc2c3f1db5 Mon Sep 17 00:00:00 2001
From: Shane Loeffler <Shane98c@users.noreply.github.com>
Date: Tue, 23 Jun 2026 16:59:05 -0500
Subject: [PATCH 1/4] publish workflow: switch to OIDC trusted publishing on
 node 24

---
 .github/workflows/publish.yaml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 207f4ba..cf8930d 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -15,10 +15,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20
+      - name: Use Node.js 24
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: "npm"
           registry-url: https://registry.npmjs.org
 
@@ -33,5 +33,3 @@ jobs:
 
       - name: Publish to npm
         run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

From 3d3195c769826deb65cf471f46b0a4914e64063a Mon Sep 17 00:00:00 2001
From: Shane Loeffler <Shane98c@users.noreply.github.com>
Date: Tue, 23 Jun 2026 17:32:45 -0500
Subject: [PATCH 2/4] ci: support node 20-24 (drop EOL 18, add 24); set engines
 node >=20

---
 .github/workflows/ci.yaml | 2 +-
 package.json              | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 203c900..a4f5742 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -12,7 +12,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [18, 20, 22]
+        node-version: [20, 22, 24]
         zarrita-version: ["0.5", "0.6", "0.7"]
 
     steps:
diff --git a/package.json b/package.json
index 167d07c..71eec7f 100644
--- a/package.json
+++ b/package.json
@@ -2,6 +2,9 @@
   "name": "icechunk-js",
   "version": "0.5.0",
   "description": "Read-only JavaScript/TypeScript reader for Icechunk repositories",
+  "engines": {
+    "node": ">=20"
+  },
   "publishConfig": {
     "access": "public"
   },

From e93f726ac5469c93860f653dc9c9974dea692e1d Mon Sep 17 00:00:00 2001
From: Shane Loeffler <Shane98c@users.noreply.github.com>
Date: Tue, 23 Jun 2026 17:55:19 -0500
Subject: [PATCH 3/4] docs: add RELEASING.md

---
 RELEASING.md | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 RELEASING.md

diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 0000000..d283817
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,10 @@
+# Releasing
+
+Publishing to npm runs in CI (`.github/workflows/publish.yaml`).
+
+1. `npm version <patch|minor|major>` — bumps `package.json`, commits, tags `vX.Y.Z`.
+2. `git push --follow-tags`
+3. `gh release create vX.Y.Z --generate-notes` — triggers the publish (the tag alone does not).
+4. CI installs, tests, builds, and publishes. Verify with `npm view icechunk-js version`.
+
+Manual fallback: `npm ci && npm run build && npm publish --access public`.

From 95a5cd5a12ce5680b2e50627e3ecdc78abfd8544 Mon Sep 17 00:00:00 2001
From: Shane Loeffler <Shane98c@users.noreply.github.com>
Date: Tue, 23 Jun 2026 18:04:05 -0500
Subject: [PATCH 4/4] docs: note manual publish lacks provenance

---
 RELEASING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/RELEASING.md b/RELEASING.md
index d283817..66c65a4 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -7,4 +7,4 @@ Publishing to npm runs in CI (`.github/workflows/publish.yaml`).
 3. `gh release create vX.Y.Z --generate-notes` — triggers the publish (the tag alone does not).
 4. CI installs, tests, builds, and publishes. Verify with `npm view icechunk-js version`.
 
-Manual fallback: `npm ci && npm run build && npm publish --access public`.
+Manual fallback (no provenance; prompts for your 2FA code): `npm ci && npm run build && npm publish --access public`.