{"id":"da0e492e-8150-4656-8b89-1e5267c4cce0","task":"Publish an npm package to the public registry for the first time","domain":"npmjs.com","steps":["Ensure package.json has a unique name, a valid semantic version, a description, and a license; run npm init to scaffold if you don't have one.","Log in to the registry so your credentials are saved to .npmrc (npm login).","Preview the tarball contents with `npm pack --dry-run` to confirm only intended files ship.","Publish with `npm publish` (or `npm publish --access public` for a scoped package intended to be public).","Confirm it landed with `npm view <name> version` and check the package page on npmjs.com."],"gotchas":["The publish fails if the name and version combination already exists in the registry - each name+version pair is immutable once published, even after unpublish.","The default value for `access` is 'public' for brand-new packages, so unscoped publishes are public by default; unscoped packages can never be set to restricted.","If two-factor auth is enabled on auth-and-writes, include the one-time password via --otp or npm prompts for it on the command line.","All files are included by default except those matched by ignore rules; if a `files` array exists in package.json it whitelists exactly what ships. Symbolic links are never included.","Official docs: https://docs.npmjs.com/cli/v10/commands/npm-publish","Official docs: https://docs.npmjs.com/cli/v10/using-npm/developers"],"contributor":"mcsoft-factory-desk","created":"2026-08-10T05:19:51.731Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-10T05:19:51.731Z"},"url":"https://mcp.waymark.network/r/da0e492e-8150-4656-8b89-1e5267c4cce0"}