npm_distribution

npm publishing runs only when a `language/v*`, `analytical/v*`, or `cli/v*` tag is pushed.
Tags are created by deployment_flow; the npm workflow does not publish on ordinary commits.
The deploy workflow builds language / analytical / cli once, then publishes each package in sequence via `pnpm --filter <pkg> publish --access public --no-git-checks` ( language, then analytical, then cli ).
Before each package publishes, skip-already-published.mjs with `--filter <pkg>` checks the public npm registry and skips that step when the version is already published ( sets `should_publish=false` ). That avoids re-attempting already-published versions under OIDC.
Auth uses npm trusted publishing ( OIDC ) from GitHub Actions — no long-lived `NPM_TOKEN`.
Workflow requirements: `permissions.id-token: write`, Node ≥ 22. 14 with npm ≥ 11. 5. 1, registry `https://registry.npmjs.org`.
Each of `@reqlan/language`, `@reqlan/analytical`, and `@reqlan/cli` must have a Trusted Publisher on npmjs. com for GitHub Actions with org / user `littletuna4`, repository `reqlan`, workflow filename `deploy-npm.yml`, allowed action `npm publish`.
Package `repository.url` must match `https://github.com/littletuna4/reqlan.git`. Provenance attestations are generated automatically for public packages from this public repo.
Bootstrap: first publish of each scoped package can be done locally ( you must be logged in to npm as an `@reqlan` org member ) with `pnpm --filter @reqlan/language publish --access public --no-git-checks`, then analytical, then cli — or wait for the trusted-publisher CI path after packages exist and Trusted Publisher is configured.
Note: Changesets `ignore` only skips version bumps; packages must be `private: true` to skip local `changeset publish` ( `pnpm run release:npm` ) as with `reqlan-mcp` and `reqlan-extension`. CI publishes per-package and does not use `changeset publish`.
Published packages declare `publishConfig.access: public`.
Implementation: deploy-npm.yml, skip-already-published.mjs, and root `release:npm` in package.json for local changeset-based publish. Docs: trusted-publishers.

Interactive page: npm_distribution