Publish tfgrid-api-client 2.13.0 to npm

[sameh-farouk]

Reminder: the in-repo JS client clients/tfchain-client-js is tfgrid-api-client@2.12.0, but npm's latest is still 1.29.1 (2.x is unpublished).

Publishing 2.x lets activation-service (and other consumers) depend on ^2.12.0 via the registry-based Docker build, instead of yarn link/file:.

Context: verified the v2 client is API-compatible with activation-service's usage (same constructor, same @polkadot/api ^10.9.1, all used methods present). See the activation-service client-upgrade work.

[sameh-farouk]

Status: blocking the activation-service v2 client upgrade and the 2.13.0 release.

The release bumps everything to 2.13.0 (PR #1100), and we want activation-service to depend on the new client (^2.13.0). But npm still only has 1.29.1, so the registry-based Docker build (yarn install) can't resolve 2.13.0. This must be published first.

Publish from the release branch

development-bump-version-to-2.13.0 (PR #1100) already has version: 2.13.0 in clients/tfchain-client-js/package.json, and the client code is identical to development (the bump only changed the version). So publish from there:

git checkout development-bump-version-to-2.13.0
cd clients/tfchain-client-js
npm whoami          # must be threefoldtech (or a maintainer with publish rights)
npm publish --dry-run
npm publish         # publishes 2.13.0 to public npm as 'latest'

(Needs the threefoldtech npm credentials — this is the actual blocker.)

Next steps (ordered — strict dependency)

1. Publish tfgrid-api-client@2.13.0 to npm (above).
2. Bump activation-service dep to ^2.13.0 and regenerate yarn.lock — must be after step 1 (yarn 404s on 2.13.0 otherwise; the lockfile needs the published tarball hash). Commit to the release branch → updates Bump version to 2.13.0 (spec v158) #1100. No Dockerfile change needed — the registry build resolves the new version.
3. Merge Bump version to 2.13.0 (spec v158) #1100 → tag v2.13.0 → publish the release.

Follow-up (durable fix)

Automate this so it isn't a recurring manual chore: add a publish-npm-client.yaml workflow triggered on tag push (npm publish in clients/tfchain-client-js using an NPM_TOKEN repo secret). Requires adding the NPM_TOKEN secret (a threefoldtech automation token).

[sameh-farouk]

Correction to step 2 — both lock files must be updated.

activation-service tracks two lock files, both currently pinning tfgrid-api-client@1.29.1:

• yarn.lock — used by the Dockerfile (yarn install); the build-critical one.
• package-lock.json — not used by the Docker build but tracked, so npm install consumers would otherwise keep resolving v1.

So step 2 (after the npm publish) is:

cd activation-service
# package.json: "tfgrid-api-client": "^2.13.0"
yarn install                       # regenerates yarn.lock
npm install --package-lock-only    # regenerates package-lock.json without touching yarn's node_modules
# commit all three to development-bump-version-to-2.13.0 -> updates #1100

Both lockfile regenerations require 2.13.0 to be on npm first (each needs the published tarball + integrity hash).

(Optional cleanup, separate from the release: drop one lockfile and standardize on yarn, since maintaining both invites drift.)