HARD GATE — Do not attempt to publish without verifying prerequisites. Missing auth tokens, stale builds, or duplicate versions cause CI failures that are hard to debug post-push.

HARD GATE — Always run --dry-run first. Package registries are append-only — a bad publish cannot be fully undone on most registries.

Publish packages to language-specific registries. Detects package type from manifest files, verifies publish prerequisites, runs the registry-specific publish command, and confirms the version appears on the registry.

Read the project root for manifest files to determine the package type:

Manifest	Registry	Publish command
package.json	npm	npm publish --access public
Cargo.toml	crates.io	cargo publish
setup.py / pyproject.toml	PyPI	twine upload dist/* or flit publish
Formula/<name>.rb	Homebrew	brew bump-formula-pr
Multiple detected	Polyglot	Error: specify registry with `–registry <npm

If no manifest is found, prompt the user to specify the type or pass --type <npm|crates.io|pypi|brew>.

Before attempting any publish, run all applicable checks:

npm (package.json): See REFERENCE.md

crates.io (Cargo.toml): See REFERENCE.md

PyPI (setup.py / pyproject.toml): See REFERENCE.md

After all prerequisite checks pass, run the registry-specific command:

See REFERENCE.md

After publish, confirm the version appears on the registry:

See REFERENCE.md

On failure, surface actionable hints:

See REFERENCE.md

Run --dry-run to verify all prerequisites without actually publishing:

See REFERENCE.md

See REFERENCE.md

→ verify: grep -ci "npm\|crates.io\|pypi\|publish\|registry" skills/publish-package/SKILL.md | awk '{if($1>=4) print "OK: semantics"; else print "FAIL: missing"}' → verify: grep -q "publish-package" SKILL-INDEX.md && echo "OK: in SKILL-INDEX" || echo "FAIL: not indexed"