◷ npm trusted publishing

Event allowlist · 48h validation window · no publish API

Will this trusted publisher survive 48 hours — and which events can publish?

0h config created——first successful publish?——48h expire if never validated
Workflow eventOIDC publish?Notes

How it works

  1. Mark whether first publish validated the config.
  2. Toggle which workflow events you expect to publish.
  3. Export a local checklist — we never talk to npm.