skill-channel-rollout

Replicates next-starters' own multi-channel skill distribution pattern — a pnpm workspace of per-skill npm packages published via Changesets (private-by-default, gated by a committed allowlist), a self-hosted Claude Code plugin marketplace, and the CI that ties them together — into another repo. It never publishes anything itself; that's a hard boundary, not a default.

What it does

Given a target repo path:

1. Checks the package manager. Reads packageManager / lockfiles; if it isn't pnpm, or there's no package.json yet, it stops and asks instead of silently choosing.
2. Checks for a stale "workspaces" field. @manypkg/get-packages (which Changesets uses for discovery) checks package.json's workspaces field before falling back to pnpm-workspace.yaml — a leftover field would silently win. Surfaced, not auto-removed.
3. Asks two questions, one at a time (AskUserQuestion): the target repo's npm scope, and its plugin command prefix.
4. Scaffolds, write-if-absent: pnpm-workspace.yaml, two package.json release scripts, packages/.gitignore, the five bin/*.mjs pipeline scripts, .changeset/config.json, docs/published-skills.json (seeded empty), and .github/workflows/skills-release.yml.
5. Runs a reference-normalization check against the target's skills/*/metadata.json, surfacing anomalies — never fixing them.

What it never does

Invoke npm publish, changeset publish, or --publish. Every package this skill scaffolds starts private: true; the published-skills allowlist starts empty. Enabling and actually releasing a package is a separate, deliberate, human-run step in the target repo, outside this skill's scope.

Use it

Read SKILL.md for the 7 invariants (one verifiable todo each) and the red flags. The references/*.mjs scripts are self-contained — copy them verbatim into the target repo's bin/; they don't depend on next-starters' own bin/ directory being present.

• references/pnpm-workspace.yaml, references/package-json-scripts-patch.jsonc, references/packages-gitignore.txt — the workspace + footprint files.
• references/generate-skill-package-json.mjs, references/sync-skill-content.mjs, references/sync-metadata-version.mjs, references/validate-skill-package.mjs, references/generate-marketplace.mjs — the five pipeline scripts.
• references/changeset-config.json, references/published-skills.seed.json — the Changesets config (privatePackages.version: false) and the empty allowlist seed.
• references/skills-release.workflow.yml — the CI job skeleton (pnpm/action-setup before actions/setup-node, pinned changesets/action@v1, token-absent guard).
• references/check-reference-normalization.mjs — the anomaly scanner run against the target repo's own skill metadata.

Companion

Implements step 14 of the multi-channel skill distribution plan this repo's own release pipeline (bin/generate-skill-package-json.mjs and siblings, .github/workflows/skills-release.yml) was built from. Run this skill's scaffold, then follow its own SKILL.md invariants 1-6 to verify the target repo's pipeline before ever touching invariant 7's boundary.