Re-publish plumb-cli@0.0.13 to npm (NPM_TOKEN expired)

[aram-devdocs]

Summary

The v0.0.13 release published successfully to crates.io, Homebrew, and GitHub Releases (binaries + installers), but the npm publish job failed.

Root cause

Publish npm package in the release.yml run failed with:

npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/plumb-cli - Not found
npm error 404  'plumb-cli@0.0.13' is not in this registry.

plumb-cli exists on npm (versions 0.0.11, 0.0.12, owner aram-devdocs) and 0.0.13 is not yet published, so this is not a "version already exists" conflict. npm returns 404 (not 403) on PUT when the auth token can't publish — i.e. the NPM_TOKEN repo secret is expired/invalid. A re-run of the failed job reproduced the same 404, so it is not transient. (The May 2026 0.0.12 publish worked, so the token has since expired or been rotated.)

Fix

1. Create a new npm Automation (or Granular) access token with publish rights for plumb-cli at https://www.npmjs.com/settings/aram-devdocs/tokens.
2. Update the repo secret:

   gh secret set NPM_TOKEN

3. Re-run only the failed npm job on the existing release run:

   gh run rerun 27829249314 --failed

   (or dispatch release.yml with tag: v0.0.13).

Acceptance

• npm view plumb-cli version returns 0.0.13.
• npx plumb-cli@0.0.13 --version works.

Notes

cargo-dist's npm job is hand-authored as publish-npm in .github/workflows/release.yml. No code change is required — only the secret rotation and a job re-run.