npm-guidelisted

Use when publishing an npm package or checking that one is ready to publish. Triggers on prompts about npm publish, publish-readiness or package.json validation (name/version/license/repository/files/publishConfig/private), idempotent publishing (skip if the version already exists), provenance and access flags, dist-tags, or platform-specific (os/cpu/libc) native-binary packages, even when the user doesn't say 'npm'.
xonovex/platform · ★ 5 · AI & Automation · score 72

Install: claude install-skill xonovex/platform

# npm Publishing Guidelines Validate publish-readiness and publish packages idempotently, with correct access, provenance, dist-tags, and platform fields. ## Core Principles - **npm requires only name + version**: `license` / `repository` / `files` are house policy, not npm rules, and `private: true` blocks publishing outright, see [references/publish-check.md](references/publish-check.md) - **Provenance needs CI + OIDC**: `--provenance` only works from a supported runner with `id-token` permission, the public registry, and a matching `repository`; it errors elsewhere, see [references/publish.md](references/publish.md) - **Access is derived**: unscoped packages are always public; scoped packages default to restricted and need `--access public` on first publish, see [references/publish.md](references/publish.md) - **Platform packages gate install**: `os` / `cpu` / `libc` restrict where a native-binary package installs; inject and restore those fields safely, see [references/publish.md](references/publish.md) ## Operations - **publish-check**: validate a package.json is publish-ready, separating npm rules from policy, see [references/publish-check.md](references/publish-check.md) - **publish**: publish a package idempotently with provenance / access / dist-tag / platform handling, see [references/publish.md](references/publish.md) ## Gotchas - Hard-requiring `license` / `repository` / `files` exceeds npm (it warns, it doesn't block), and rejecting a `repository` shorthan