[wf9a5m75]

Changes npm-publish.yml to publish through npm's trusted publishing (OIDC). The two most recent runs failed with EOTP, because the token couldn't publish without a one-time password.

All 21 @mapconductor packages already on npm now have a trusted publisher for MapConductor/react-sdk / npm-publish.yml, with npm publish allowed.

Changes

• permissions: id-token: write: lets the job get an OIDC token, which npm exchanges for a short-lived publish token.
• Update npm step: trusted publishing needs npm 11.5.1 or later, and Node 22 ships npm 10.
• --provenance=false on npm publish: under trusted publishing npm generates provenance automatically, and the registry checks it against repository.url. Most packages have no repository field, and js-vectorstyle and react-vectortile name their own repositories, so it would not match this repository.
• NODE_AUTH_TOKEN: stays as the fallback. A trusted publisher can only be added to a package that already exists, so a package's first publish still needs the token.

For the 0.3.0 release

• js-vectorstyle, react-vectortile and react-for-deckgl have never been published, so they still go through NPM_TOKEN. With the current token that fails with EOTP.
• Until the token has "Bypass two-factor authentication" turned on, add those three to exclude alongside the four react-icons packages. The other 20 then publish through OIDC.
• npm marks the new trusted publishers as pending until one publish validates them, by Oct 31, 2026 (about 16:40–17:02 UTC, depending on the package).
  • react-icons stays at 0.2.0 and is skipped, so its trusted publisher won't be validated by this release.

Checks

• The workflow file parses, and its permissions and step order are as expected.
• The publish itself can't be tested before a real run.