skill-factory

aubron

A package factory for publishing TypeScript packages to npm under the @aubron/* scope. pnpm + Turborepo monorepo with one source of truth for every standard (TS / ESLint / Prettier / tsup), shipped as published config packages.

The trick: packages reference shared config by package name (e.g. "extends": "@aubron/tsconfig/cli.json"). That string resolves via the workspace symlink inside the monorepo and via node_modules in a standalone repo — so an ejected package needs zero config rewriting.

Layout

packages/
  tsconfig/        @aubron/tsconfig        — shared tsconfigs (base/lib/cli)
  eslint-config/   @aubron/eslint-config   — flat ESLint config
  prettier-config/ @aubron/prettier-config — Prettier config
  tsup-config/     @aubron/tsup-config     — tsup build preset
  skill-tools/     @aubron/skill-tools     — validate + release Claude skills
  skill-factory/   @aubron/skill-factory   — meta-skill: how to author/ship skills
  ankerts/         @aubron/ankerts         — AnkerMake/eufyMake M5 SDK
  ankerts-cli/     @aubron/ankerts-cli     — `ankerts` CLI (thin shell over the SDK)
scripts/gen.ts     — `new` + `eject` commands; templates/ alongside
.claude-plugin/marketplace.json — generated catalog of the skill packages

Create a package

pnpm new <name> --type <lib|cli|skill> [--description "..."]
pnpm new color --type lib
pnpm new todo --type cli --description "A todo CLI"
pnpm new my-skill --type skill --description "What it does + when to use it"

--type skill scaffolds a Claude Agent Skill (a SKILL.md + a plugin manifest) and wires it into the aubron plugin marketplace. See the skill-factory skill for the full author → validate → release runbook.

This scaffolds packages/<name>, fully configured and publish-eligible, drops a starter changeset, and runs pnpm install to link it. Then:

pnpm --filter @aubron/<name> build
pnpm --filter @aubron/<name> test

Day-to-day

pnpm turbo run build lint typecheck test   # everything, cached
pnpm format                                 # Prettier write
pnpm format:check                           # Prettier check

Release flow (CI-first)

The only local action is declaring intent:

1. pnpm changeset — pick packages + bump type, write a summary, commit the file.
2. Open a PR and merge it. CI is required to have a changeset for any packages/** change.
3. On merge to main, the release workflow opens a Version Packages PR that bumps versions and updates changelogs.
4. Merge that PR → CI builds and runs changeset publish → packages go to npm with provenance.

Eject a package to its own repo

pnpm eject <name> [--dest <dir>] [--push] [--private]
pnpm eject ankerts --push

Eject is copy-out only (it never mutates the source package). It rewrites every workspace:* / catalog: specifier to a concrete semver range (mirroring what pnpm does on publish), flattens the package to the destination root, copies the config files verbatim (their @aubron/* references now resolve from npm), and stamps the standalone toolchain (CI, release, Changesets, Dependabot, Lefthook, CLAUDE.md). The new repo inherits identical standards.

Standalone install/build requires the @aubron/* config packages to be published to npm first (they're referenced by name). Publish from this monorepo before ejecting consumers.

Publishing

Auth is npm Trusted Publishing (OIDC) — no long-lived token is stored (npm caps tokens at 90 days, so we don't depend on one). Provenance is on (publishConfig.provenance: true) and the release workflow has id-token: write.

⚠️ First publish of a package is a one-time MANUAL, LOCAL release

Trusted Publishing is configured per package, on a package that already exists on npm. A brand-new package can't be pre-trusted — so the very first publish of each @aubron/* package can't come from the tokenless CI flow. You have to bootstrap it by hand, once, from your machine. After that, CI does everything.

The chicken-and-egg, concretely:

new package → CI publish needs OIDC → OIDC needs a trusted publisher
→ trusted publisher needs the package to exist → package needs a publish ✋

Bootstrap (run once, locally, from a clean main after the package is merged):

# 1. Authenticate. A short-lived (≤90-day) granular token scoped to publish
#    @aubron/* is plenty for a one-off — revoke it when you're done. Or `npm login`.
npm whoami                      # confirm the right account / @aubron access

# 2. Apply pending changesets → real versions (0.0.0 → 0.1.0) + changelogs
pnpm changeset version
pnpm install                    # refresh the lockfile after the bumps