manual-task: NPM_TOKEN is invalid — acture-forms-rjsf@1.1.0 is versioned on main but not published

[thorwhalen]

Blocked on the repo owner — I cannot fix this from a session. Needs npm account access.

State right now

• main carries the version bump: acture-forms-rjsf@1.1.0 (release PR chore(release): version packages #60 merged, chore(release): bump versions).
• npm still serves 1.0.0. The publish step failed.
• So the tree and the registry disagree, and Widen acture-forms-rjsf's @rjsf/* peer range to 6.x — @rjsf/shadcn ships on 6 only, so shadcn consumers cannot install it #57's fix — accepting @rjsf 6.x so @rjsf/shadcn becomes installable alongside the adapter — is not yet usable by any consumer, which was the entire point of the issue.

The failure

Run 33027028316, step "Changesets — version PR or publish":

npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/acture-forms-rjsf
npm error 404  'acture-forms-rjsf@1.1.0' is not in this registry.

A 404 on a publish PUT is an auth failure, not a missing package. npm answers unauthenticated/unauthorised writes with 404 rather than 403 so it does not leak whether a package name exists. acture-forms-rjsf@1.0.0 is on the registry right now, so the name plainly exists — the credential is what is wrong. The log confirms NPM_TOKEN was present and .npmrc was written from it, so it is not a missing secret: it is an invalid or expired one.

What only you can do

One of:

1. Rotate NPM_TOKEN — mint a new automation token on npm, set it as the repo secret, and re-run the failed job. Fastest path; puts 1.1.0 on the registry within minutes.
2. Move to npm Trusted Publishing (OIDC) — the standing preference recorded for this repo, and the durable fix. It removes the long-lived token entirely, so it cannot expire and cannot be clobbered by a secrets sync. This has bitten this repo before.

Option 2 is the one worth the time: this is a recurrence, not a first occurrence, and every rotation buys only until the next expiry.

Nothing else is broken

The version bump on main is the normal changesets state after a failed publish, not corruption. Once the credential works, re-running the release job publishes 1.1.0 from the same commit — no revert, no re-version, no new changeset needed.

Downstream

reelee-web consumes acture-* from the registry (semver ranges pinned in package-lock.json), so until this publishes it will keep resolving acture-forms-rjsf@1.0.0 and the shadcn theme stays uninstallable there. Nothing downstream needs changing — it just needs the package to exist.

Context: opened while landing #57 during a federation-wide backlog sweep. #57 itself is complete and merged (ea386c7); this is purely the delivery step.