Publishing

Two paths to the same registry: the one-command CLI flow, or plain npm publish for CI and existing release tooling.

Publish with the CLI

From a package directory whose name is scoped to your organisation:

pln publish

pln publish reads the package name, mints a short-lived publish token for the right scope, and runs the publish. No long-lived credentials end up on disk; the token has expired before you have finished reading the output. Pass --tag next (or any dist-tag) to publish without moving latest.

Publish with npm

For CI pipelines and release scripts, create a registry token with publish scope, put it in .npmrc, and use standard tooling:

npm publish

The registry implements the npm publish protocol, so changesets, release-it, and friends work without adapters.

Versions and dist-tags

Published versions are immutable: a version, once published, always refers to the same bytes. Dist-tags (latest, next, anything you define) are the movable pointers. The package page shows every version and where each tag points.

Integrity and storage

Tarballs are stored content-addressed by their integrity hash, the same hash your package manager verifies on install. What you publish is byte-for-byte what installs, and identical content is stored once no matter how many versions reference it.