publishing-a-new-package

A 404 on PUT for a brand-new package name means the CI token lacks permission to create new names in the scope. Granular tokens limited to a hand-picked package list cannot include a package that does not exist yet. Grant read+write on the whole scope or publish once manually.

Always use pnpm publish, never npm publish, in a pnpm monorepo. pnpm rewrites catalog: specifiers to real version ranges when packing, while npm publish ships the literal catalog: string and breaks every consumer install.

No. npm requires the package to already exist before a trusted publisher can be configured. The order is: first publish by token, then configure the trusted publisher on npmjs.com, then switch CI to OIDC.

The exports map likely omits ./package.json or points to paths not covered by the files field, so targets are missing from the tarball. Neither npm pack nor npm install catches this; it only surfaces when a consumer imports that entry.

Install it in a different repository, ideally npm-based rather than pnpm, then import every entry in the exports map, build, and grep the build output to confirm the imported values reached the bundle. A green build alone does not prove the values landed.

The id-token: write permission must be granted at both the caller job and the reusable workflow's publish job, since a called workflow cannot exceed the caller's permissions. Also check pnpm/action-setup versions, as v4.4.0 broke pnpm's OIDC publish.