solo-npm

AI skills for every npm command a solo dev runs — publish, version, dist-tag, deprecate, audit, deps, owner, trust — with verify gates and provenance baked in.

🤖 Built to be driven by Claude

Open Claude Code in your repo, say "Integrate solo-npm and follow the Quick Start", and from then on every release, audit, hotfix, and dep upgrade is one prompt away. No manual npm version, no manual git tag, no manual changelog — Claude orchestrates the skills end-to-end.

For solo devs, this means:

• Daily release: type "ship it" — Claude runs /verify, bumps the version from your commits, tags, watches CI, and verifies the registry attestation.
• CVE alert: type "audit my deps" — Claude classifies, fixes Tier-1, runs /verify, commits the bump.
• Hotfix on v1: type "fix the v1 rate-limiter, it crashes on 429" — Claude branches, applies the fix, ships the patch with the right dist-tag.
• Morning check: type "how are my packages doing" — Claude renders a portfolio dashboard.

No CLI to memorise. No browser tabs to open. Just describe what you want.

---

Table of contents

• Why solo-npm?
• Commands at a glance
• npm coverage
• Tell Claude
• Quick Start
• Commands — detail
• Composition with agent-skills
• Architecture
• Diagnostic prompts (symptom → skill)
• Advanced
• See also

---

Why solo-npm?

You're a solo developer — or running a small group of LLM agents — shipping npm packages. PRs are disabled in your repos (issue/discussion contribution model only). There's no committee, no second pair of human eyes.

Existing release tooling is built for teams: PR-based workflows, multi-stage approvals, complex changelog negotiation. In a solo or agent-driven context that overhead becomes friction — and friction makes you skip steps when you're moving fast. Skipped steps make unsigned, unverified, opaque releases.

solo-npm replaces that friction with one structured AskUserQuestion checkpoint per release and silent automation everywhere else. The skills bake in opinionated defaults — SLSA provenance attestation, OIDC Trusted Publishing, conventional-commit-driven version bumps, verify-gated dep upgrades — so you can't accidentally ship something untested or unsigned.

Beyond the release moment, the operate skills (/status, /audit, /deps) replace the morning ritual of opening five browser tabs to check on your portfolio. One terminal command per concern.

Tools used under the hood: npm-trust (CLI for OIDC trust config), gagle/prepare-dist (monorepo dist translation, optional).

---

Commands at a glance