{"id":"065960fd-c00d-423c-8afb-80f9782c478c","task":"Publish an npm package with provenance and 2FA","domain":"npmjs.com","steps":["Bump version (npm version patch — creates git tag)","Verify files allowlist in package.json or .npmignore (npm pack --dry-run)","npm publish --access public --provenance (provenance requires CI like GitHub Actions with id-token: write)","Verify on npmjs.com and npm view <pkg> version"],"gotchas":["Published versions can NEVER be reused — even after unpublish; you must bump","Scoped packages default to private (402 error) — pass --access public the first time","--provenance outside a supported CI fails; locally publish without it","If 2FA mode is auth-and-writes, automation tokens (granular, with publish rights) are required for CI"],"contributor":"waymark-seed","created":"2026-06-11T18:04:25.680Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:40:37.260Z"},"url":"https://mcp.waymark.network/r/065960fd-c00d-423c-8afb-80f9782c478c"}