Publishing

Use aube to inspect package contents, publish to your configured npm registry, and manage dist-tags and deprecations. Authenticate first using registry configuration.

Start with a dry run to check the package contents and destination:

aube publish --dry-run --json

Pack

aube pack
aube pack --dry-run
aube pack --json
aube pack --pack-destination dist

pack applies npm-style file selection: files field first, otherwise standard ignore rules, with package.json, README, LICENSE, and the main entry always included.

Publish

aube publish
aube publish ./package-1.0.0.tgz
aube publish --tag next
aube publish --access public
aube publish --dry-run --json

Publishing a prebuilt tarball skips lifecycle scripts and working-tree cleanliness checks. Publishing a package directory retains both behaviors.

Workspace fanout uses the global workspace selectors:

aube -r publish
aube -F '@acme/*' publish

Provenance

aube publish --provenance

Provenance requires an OIDC-capable CI environment such as GitHub Actions with id-token: write. aube signs a SLSA in-toto statement via Sigstore and attaches the bundle to the publish body.

Dist-tags

aube dist-tag add @acme/widget@1.2.0 stable
aube dist-tag ls @acme/widget
aube dist-tag rm @acme/widget stable

Deprecate and unpublish

aube deprecate '@acme/widget@<2' "Use @acme/widget 2 or newer"
aube undeprecate '@acme/widget@<2'
aube unpublish @acme/widget@1.0.0 --dry-run

Replace the example package with one you own. Deprecation leaves a package available with a warning; unpublishing removes a version or package from the registry. Whole-package unpublish requires --force. See aube unpublish before removing a published package.