npm Publishing

This page is for maintainers preparing MeshKit package publication. It is not part of the normal adopter path.

User-facing docs should point developers to install @meshkit/meshkit first, then runtime, Core, CLI, or MCP packages only when needed.

Publishing Checklist

Before publishing:

1. Confirm package names use the @meshkit/* scope.
2. Confirm package metadata matches the release plan.
3. Build all packages.
4. Run dry-pack and dry-publish checks.
5. Run post-publish smoke checks against packed artifacts.
6. Confirm docs examples use scoped imports.
7. Confirm no token, .npmrc, private key, or credential leaks into logs or packages.

Evidence Commands

npm pack --workspaces --dry-run
npm run publish:dry
npm run postpublish:smoke

Use the repository release scripts that match the current package manager and release process.

Redaction Rules

Never capture:

• npm tokens
• .npmrc
• registry auth headers
• provider tokens
• private keys
• wallet controls
• decrypted MeshKit content

Safe to capture:

• package name
• package version
• tarball filename
• file list summary
• command exit code
• sanitized smoke-test output

Docs Coupling

Any release that changes user behavior must update:

• Install
• Version compatibility
• Roadmap status
• Reference pages affected by the API change
• Migration notes when behavior is breaking

Next Steps

• Version compatibility
• Roadmap status
• Security reviews