A release guide for publishing JavaScript packages to npm, the package registry commonly used by Node.js projects, and for submitting related MCP registry entries. It includes version checks, access settings, clean installation tests, and release prerequisites.

Use it to verify versions, publish packages, confirm public access, test CommonJS and ESM imports, check MCP registry status, and complete the required release steps.

It helps catch incomplete releases, private scoped packages, missing authentication, failed installs, and registry entries that have not become available yet.

How eternal-roman/ledger configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to eternal-roman/ledger. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/eternal-roman/ledger/main/.grok/skills/publish-npm/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/eternal-roman/ledger

Made for: Claude Code.

Or install ledger, the plugin that ships this one along with the rest of its 8 skills, 4 commands, 1 agent, 1 hook, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/eternal-roman/ledger/publish-npm/github.svg)](https://agentmods.dev/skills/eternal-roman/ledger/publish-npm)

Your own site

<a href="https://agentmods.dev/skills/eternal-roman/ledger/publish-npm"><img src="https://agentmods.dev/badge/skills/eternal-roman/ledger/publish-npm/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/eternal-roman/ledger/publish-npm"><img src="https://agentmods.dev/badge/skills/eternal-roman/ledger/publish-npm.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 122 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,266 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00122	$0.02266
Opus 5	$0.00061	$0.01133
Sonnet 5	$0.00024	$0.00453
Haiku 4.5	$0.00012	$0.00227

Measured 10d ago against content hash 0c60fd667b55, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

publish-npm scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/npm-otplease.cjs), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.grok/skills/publish-npm/SKILL.md · 139 lines

How it starts

The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/publish-npm

Git Release (/release) is not npm. This skill publishes packages and the MCP registry entry after git is done.

REQUIRED BACKGROUND: Windows sessions load pwsh-shell-guard before any terminal. Do not paste tokens into chat. Do not commit .npmrc.

When blocked or npm/MCP CLI versions change, re-fetch the URLs in references/SOURCES.md and follow the live page, not memory.

Done means all of these

npm view <pkg> version --userconfig <empty-file> equals the intended version (no session).
npm access get status <pkg> is public for every scoped package meant to be public.
Clean-room install proves the artifact: CJS require, ESM import, and the MCP banner.
If this repo ships MCP: registry search returns io.github.eternal-roman/ledger at that version, status active.
Tracking issue closed only after 1–4.

+ @scope/name@version is not done. First scoped publish is private until npm access set status=public. Registry GET can 404 for minutes after a successful PUT.

Preconditions

On main matching origin/main. npm run check:versions and npm run verify:full green. npm whoami is the intended owner. npm profile get shows two-factor auth: auth-and-writes (or equivalent). Scoped package.json has "publishConfig": { "access": "public" } or every publish uses --access public.

Ledger extras before any tarball leaves the machine:

mcp/package.json has "mcpName" exactly equal to mcp/server.json "name" (today io.github.eternal-roman/ledger).
mcp/server.json "description" length ≤ 100 (live schema: https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json ).
mcp/package.json depends on the kernel by semver (^X.Y.Z), never file:.
Kernel version on npm must exist before publishing MCP.

npm run check:versions now also fails if mcpName ≠ server.json name, if description is empty or > 100 chars, or if server.json top version and packages[0].version disagree. Do not trust server.json $schema for the length cap — registry uses the live schema in references/SOURCES.md.

Read the full file on GitHub · 139 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

10d ago First seen · 139 lines · 122 tokens per session scan A 0c60fd667b55

Subscribe to this mod's changes

publish-npm is a skill published in the GitHub repository eternal-roman/ledger (1 stars, last pushed today), licensed MIT. It adds 122 tokens to every session and 2,266 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Deterministic Git and workflow Languages Releases TypeScript accounting ai-agents audit bookkeeping double-entry

release-process

Pre-release validation, npm publish procedures, and post-publish verification.

github/gh-aw · 16 tokens

package-release-engineering

Use when preparing, validating, or documenting the release workflow for a TypeScript library published to npm, including semver, changelog, tagging, and publish safety.

sampleXbro/agentsmesh · 38 tokens

draft-release-notes

Author the committed release-notes file for a Prisma 8 release (stable or 8.0.0-rc.N) by enumerating the merged PRs since the previous release v tag (stable or -rc.N), resolving opaque TML-NNNN: titles via Linear context (never copied verbatim), triaging public-worthiness, and writing categorized notes — breaking…

prisma/orm · 174 tokens

publish-npm-version

Cuts the next release of Prisma 8: bumps the root package.json version (on the v8 RC line: 8.0.0-rc.N → rc.N+1), propagates it to every workspace package, and opens a PR titled "chore(release): bump to ". When the maintainer merges the PR, the Publish to npm workflow runs automatically and ships the new version to npm…

prisma/orm · 159 tokens

create-draft-pr

Create a draft pull request for the current session. Use when the user wants to open a draft PR with the session's changes.

microsoft/vscode · 31 tokens

create-pr

Create a pull request for the current session. Use when the user wants to open a PR with the session's changes.

microsoft/vscode · 27 tokens

ledger: Skill for Claude Code