The bin field npm deletes on publish
npm 11 silently removes any bin entry whose value starts with
./. The package still builds, tests, packs and installs. It just has no
executables. Pick a manifest below to see what the registry would have stored.
Measured, not assumed
Five manifests, published with --dry-run on npm 11.19.0:
| bin value | entries stripped |
|---|---|
| "./dist/cli.js" (one key) | 1 |
| "./dist/cli.js" (two keys) | 2 |
| "./dist/cli.js" (string form) | 1 |
| "dist/cli.js" (one key) | 0 |
| "dist/cli.js" (two keys) | 0 |
The key count and the string-vs-object form are irrelevant. Only the leading
./ matters.
Why nothing local caught it
| Check | Verdict | Why it missed |
|---|---|---|
| npm run build | pass | tsc never reads bin |
| npm test (34) | pass | spawns dist/cli.js by path, not by bin name |
| npm pack | pass | keeps the field intact in the tarball |
| CI (41 checks) | pass | never publishes |
| npm publish | warn | the only place it shows, and only as a warning |
A successful publish would have exited 0. The failure would first have
appeared to a stranger running npx orchestkit against a package that
installs cleanly and has no command.