# npm Publishing Guide

This guide is for repository maintainers. Publishing is manual until npm trusted publishing is configured.

## Before the First Publish

1. Confirm the npm name `ravenstrike-agent` is available.
2. Confirm `package.json` points to `purnanandiboina/RAVENSTRIKE`.
3. Enable two-factor authentication on the npm account.
4. Review `README.md`, `SECURITY.md`, and `CHANGELOG.md`.

## Release Checks

From a clean clone:

```bash
npm ci
npm run check
npm audit --audit-level=high
npm pack --dry-run
```

Inspect the dry-run list. It must not contain `node_modules`, `.env` files, caches, logs, test-only planning documents, or package archives.

## Version and Publish

Choose the appropriate semantic version change:

```bash
npm version patch
# or: npm version minor
# or: npm version major
```

Push the generated commit and tag through GitHub Desktop, then authenticate and publish:

```bash
npm login
npm whoami
npm publish --access public
```

The `prepublishOnly` script runs the full release check before npm accepts the package.

## Verify the Published Package

```bash
npm view ravenstrike-agent version
npx --package ravenstrike-agent ravenstrike --help
```

Create a GitHub release matching the npm version and summarize user-visible changes from `CHANGELOG.md`.

## Do Not Publish From a Developer Working Tree When

- tests or validation fail
- high or critical runtime vulnerabilities are unresolved
- package contents include local or sensitive files
- public documentation overstates implemented capabilities
- the changelog and version do not match the release