chore(wasm): switch tlsn-wasm npm release from CI to manual script

The releng.yml workflow relied on an NPM_TOKEN secret that expires every
90 days, which made it almost always broken at release time. Replace it
with crates/wasm/publish.sh, which downloads the CI-built artifact for a
given tag and runs `npm publish` locally under a maintainer account.

Author: heeckhau

.github/workflows/releng.yml

@@ -12,6 +12,31 @@ For browser usage, check the [`tlsn-extension`](https://github.com/tlsnotary/tls
 cargo install wasm-pack
 ```
 
+## Releasing to npm
+
+Releases are published manually. CI builds and uploads a `tlsn-wasm` package
+artifact on every tagged build (see `ci.yml`); `publish.sh` downloads that
+artifact and pushes it to npm.
+
+One-time setup:
+
+1. Be a maintainer of [`tlsn-wasm`](https://www.npmjs.com/package/tlsn-wasm) on
+   npm.
+2. Authenticate locally:
+   - `gh auth login` (needs read access to `tlsnotary/tlsn` Actions artifacts)
+   - `npm login` — verify with `npm whoami`. 2FA OTP is prompted at publish
+     time.
+
+To publish a tag (after the CI run for that tag has completed successfully):
+
+```bash
+./publish.sh v0.1.0-alpha.16
+```
+
+The script shows a `npm publish --dry-run` and asks for confirmation before
+actually publishing. Pass a second argument to use a non-`latest` dist-tag,
+e.g. `./publish.sh v0.1.0-alpha.16 alpha`.
+
 ## Links
 
 - [Website](https://tlsnotary.org)

crates/wasm/README.md

@@ -0,0 +1,80 @@
+#!/bin/sh
+
+# Publish a tagged tlsn-wasm build from GitHub Actions to npm.
+#
+# Usage:
+#   ./publish.sh <tag> [npm-dist-tag]
+#
+# Example:
+#   ./publish.sh v0.1.0-alpha.16
+#   ./publish.sh v0.1.0-alpha.16 alpha
+#
+# Requires: gh (authenticated), npm (logged in as a maintainer of `tlsn-wasm`).
+
+set -e
+
+TAG="${1:-}"
+NPM_TAG="${2:-latest}"
+
+if [ -z "$TAG" ]; then
+    echo "Usage: $0 <tag> [npm-dist-tag]"
+    echo "Example: $0 v0.1.0-alpha.16"
+    exit 1
+fi
+
+REPO="tlsnotary/tlsn"
+ARTIFACT_NAME="${TAG}-tlsn-wasm-pkg"
+
+for cmd in gh npm; do
+    if ! command -v "$cmd" >/dev/null 2>&1; then
+        echo "Error: $cmd not found in PATH."
+        exit 1
+    fi
+done
+
+if ! npm whoami >/dev/null 2>&1; then
+    echo "Error: not logged in to npm. Run 'npm login' first."
+    exit 1
+fi
+
+WORK_DIR="$(mktemp -d -t tlsn-wasm-publish.XXXXXX)"
+trap 'rm -rf "$WORK_DIR"' EXIT
+echo "Working in $WORK_DIR"
+
+echo "Looking for successful ci.yml run for $TAG..."
+RUN_ID=$(gh run list \
+    --repo "$REPO" \
+    --workflow ci.yml \
+    --branch "$TAG" \
+    --status success \
+    --limit 1 \
+    --json databaseId \
+    --jq '.[0].databaseId')
+
+if [ -z "$RUN_ID" ] || [ "$RUN_ID" = "null" ]; then
+    echo "Error: no successful ci.yml run found for tag $TAG."
+    echo "Check: gh run list --repo $REPO --workflow ci.yml --branch $TAG"
+    exit 1
+fi
+echo "Found CI run: $RUN_ID"
+
+echo "Downloading artifact $ARTIFACT_NAME..."
+gh run download "$RUN_ID" \
+    --repo "$REPO" \
+    --name "$ARTIFACT_NAME" \
+    --dir "$WORK_DIR/pkg"
+
+echo "Tarball preview:"
+(cd "$WORK_DIR/pkg" && npm publish --dry-run --tag "$NPM_TAG")
+
+printf "Publish %s to npm with dist-tag '%s'? [y/N] " "$ARTIFACT_NAME" "$NPM_TAG"
+read -r REPLY
+case "$REPLY" in
+    y|Y|yes|YES) ;;
+    *) echo "Aborted."; exit 1 ;;
+esac
+
+cd "$WORK_DIR/pkg"
+npm publish --tag "$NPM_TAG"
+
+echo "Published $ARTIFACT_NAME to npm under tag '$NPM_TAG'."