Package releases and publishing

Documentation index · CLI setup

The public package is awwwth on npm. Version 0.2.0 was published on 26 September 2026 and verified by comparing its registry checksum with the tested tarball and running its CLI through npx.

Release contents

The package lives in packages/awwwth, separately from the private identity-server package at the repository root. Its npm bin entry exposes awwwth as a command.

The published files are package.json, README.md, bin/awwwth.mjs, and the gateway and widget files under lib/. The identity-server source, deployment configuration, environment files, private keys, and tests are not included.

Test a release

Run from the repository root:

bun run build
bun run test
bun run test:sso

The package tests cover file preservation, dry-run behavior, conflicting files and symlinks, secret-file permissions, configuration validation, encrypted cookie integrity, and ID-token checks. See Shared sign-in for the integration-test prerequisites.

Build and inspect the package

For a new release, first update version in packages/awwwth/package.json. Do not reuse a version already published. The commands below use 0.2.1 as an example; substitute the actual release version.

cd packages/awwwth
npm pack --dry-run
mkdir -p ../../dist
npm pack --pack-destination ../../dist
cd ../..

Inspect the listed files before publishing. Smoke-test the local artifact:

npm exec --offline --yes --package=./dist/awwwth-0.2.1.tgz -- awwwth --help

For local source development without packing:

node packages/awwwth/bin/awwwth.mjs --help

Authenticate and publish

Use an npm account authorized to publish this package. Enable account 2FA through npm's Account settings and complete the security-key or biometric setup. Save recovery codes privately. Logging in does not itself enable 2FA. See npm's official 2FA instructions.

From the repository root:

npm login
npm whoami
npm publish ./dist/awwwth-0.2.1.tgz --access public

Complete any browser authentication prompt locally. Do not put passwords, tokens, recovery codes, or one-time codes into repository files or documentation.

The leading ./ is significant: it identifies the artifact as a local file. The path must refer to the tested tarball. An absolute path also works.

Verify publication

npm view awwwth@0.2.1 name version dist.shasum --json
npx --yes awwwth@0.2.1 --help

Check the published checksum against the npm pack output. Once published, consumers can use npx awwwth for the current default release or pin a version explicitly.

Public availability means anyone can download the CLI. It does not expose or create application credentials, deploy the identity server, or automatically update gateways already generated in other repositories.

Publishing troubleshooting

The npm package format and executable mapping are documented in npm's package manifest reference.