NPM_TOKEN cannot publish to the @nself scope: both SDKs stuck at 1.3.3

[acamarata]

@nself/sdk and @nself/plugin-sdk are both stuck on 1.3.3 on npm. v1.3.4 is released and tagged, but the SDK publishes fail.

Two separate problems. One is fixed; this issue is the other.

Fixed (#300): pnpm never received the token at all. actions/setup-node writes //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN} and relies on npm expanding ${VAR}; pnpm does not, so it published unauthenticated and npm masked it as a generic 404. Both workflows now write the resolved token before publishing.

That fix demonstrably worked — the retry after it produced:

npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log

Provenance signing requires authentication, so the token now reaches pnpm.

What remains: the token cannot write to the @nself scope

npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@nself%2fsdk - Not found
npm error 404  '@nself/sdk@1.3.4' is not in this registry.

npm returns 404 rather than 403 for an authenticated caller lacking permission on a scoped package, so as not to confirm the package exists. @nself/sdk@1.3.3 plainly does exist, so this is a permissions result, not a missing package.

Supporting evidence:

Fact	Value
@nself/sdk maintainer	acamarata <alisalaah@gmail.com>
1.3.3 published	2026-08-26, not by this workflow
Runs of "Publish @nself/sdk to npm" ever	2, both failures, both today
Org secret NPM_TOKEN last set	2026-06-19
NPM_TOKEN in the local vault	authenticates as 401 — expired

So this publish path has never succeeded. Earlier releases were published by hand, which is why nobody noticed.

What a human needs to do

An agent should not mint or rotate credentials, and the vault copy is expired, so there is no valid token available to fix this automatically.

1. Create an npm Automation token on the acamarata account with publish rights on the @nself scope: https://www.npmjs.com/settings/acamarata/tokens
2. Set it as the org secret:

   gh secret set NPM_TOKEN --org nself-org --visibility all

3. Update ~/.claude/vault.env with the same value (the current one is expired).
4. Re-run both publishes:

   gh workflow run sdk-ts-publish.yml     --repo nself-org/cli --ref main
   gh workflow run sdk-ts-sdk-publish.yml --repo nself-org/cli --ref main

5. Confirm: npm view @nself/sdk version and npm view @nself/plugin-sdk version both report 1.3.4.

Worth noting

The workflow header claims "Without NPM_TOKEN, this workflow skips publish steps gracefully (no-op success)." That is the dangerous half of this: a missing token silently no-ops, so the only signal anything is wrong is a release quietly shipping without its SDKs. #300 makes the auth step fail loudly when NPM_TOKEN is absent, but a token that is present and insufficient still surfaces only as a 404 that names the wrong problem.

Worth considering a post-release assertion that npm view <pkg> version matches the tag, so a silent SDK gap cannot survive a release again.