Add GitHub workflow for publishing the list to NPM

.github/workflows/generate-tokenlists.yml

@@ -11,21 +11,20 @@ jobs:
     runs-on: ubuntu-latest
 
     permissions:
-      # Give the default GITHUB_TOKEN write permission to commit and push the
-      # added or changed files to the repository.
       contents: write
+      id-token: write
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.10"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
         with:
           enable-cache: true
 
@@ -37,7 +36,48 @@ jobs:
 
       # Commit all changed files back to the repository
       - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
         with:
           commit_message: "Update tokenlist-mainnet.json"
           file_pattern: "tokenlist-mainnet.json"
+
+      # ---- npm package build & publish ----
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install npm dependencies
+        working-directory: npm
+        run: npm ci --ignore-scripts
+
+      - name: Audit dependencies
+        working-directory: npm
+        run: npm audit --audit-level=high
+
+      - name: Build package
+        working-directory: npm
+        run: npm run build
+
+      - name: Validate package contents
+        working-directory: npm
+        run: npm pack --dry-run 2>&1
+
+      - name: Check if version already published
+        id: check
+        working-directory: npm
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          CURRENT=$(npm view @monad-crypto/token-list version 2>/dev/null || echo "0.0.0")
+          if [ "$CURRENT" = "$VERSION" ]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish to npm
+        if: steps.check.outputs.skip != 'true'
+        working-directory: npm
+        run: npm publish

.gitignore

@@ -1,2 +1,9 @@
 .env
 .DS_Store
+
+# npm package build artifacts
+npm/src/mainnet.ts
+npm/src/testnet.ts
+npm/src/index.ts
+npm/dist/
+npm/node_modules/

npm/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Monad Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

npm/README.md

@@ -0,0 +1,74 @@
+# @monad-crypto/token-list
+
+[![npm](https://img.shields.io/npm/v/@monad-crypto/token-list)](https://www.npmjs.com/package/@monad-crypto/token-list)
+[![license](https://img.shields.io/npm/l/@monad-crypto/token-list)](./LICENSE)
+
+The official curated list of tokens on the Monad network, maintained by the Monad team. It covers both mainnet (chain ID `143`) and testnet (chain ID `10143`), and includes ERC-20 metadata, logo URIs, CoinGecko IDs, and cross-chain bridge information where available.
+
+This package is intended for wallets, DEX frontends, explorers, and any application that needs a reliable, up-to-date source of Monad token metadata.
+
+## Install
+
+```sh
+npm install @monad-crypto/token-list
+# or
+pnpm add @monad-crypto/token-list
+# or
+yarn add @monad-crypto/token-list
+# or
+bun add @monad-crypto/token-list
+```
+
+Requires Node.js 18 or later.
+
+## Quick Start
+
+Each list is exported as a plain object. No async loading, no network requests.
+
+```ts
+import { mainnetTokenList } from "@monad-crypto/token-list";
+
+// The full list object
+console.log(mainnetTokenList.tokens); // Token[]
+
+// Find a specific token
+const usdc = mainnetTokenList.tokens.find((token) => token.symbol === "USDC");
+```
+
+## Token Interface
+
+Each entry in the `tokens` array follows this structure:
+
+```ts
+interface Token {
+  chainId: 143 | 10143;    // 143 = mainnet, 10143 = testnet
+  address: `0x${string}`;  // checksum address
+  name: string;            // e.g. "USD Coin"
+  symbol: string;          // e.g. "USDC"
+  decimals: number;        // e.g. 6
+  logoURI: string;         // hosted image URL
+  extensions?: {
+    coinGeckoId?: string;
+    bridgeInfo?: {
+      protocol: "LayerZero OFT" | "Wormhole" | "Circle CCTP" | /* … */;
+      bridgeAddress: `0x${string}`;
+    };
+    // token address on other chains, keyed by chain ID
+    crossChainAddresses?: Record<string, { address: `0x${string}` }>;
+  };
+}
+```
+
+The `extensions` field is only present for tokens that have additional metadata. Bridged tokens include `bridgeInfo` and their canonical addresses on other chains in `crossChainAddresses`.
+
+## Versioning
+
+The package version reflects the token list's own `version.major.minor.patch` field and is bumped on every publish. Pinning to a specific version gives you a stable snapshot, but staying on the latest is recommended for accurate token data.
+
+## Contributing
+
+Token additions and updates are managed in the [monad-crypto/token-list](https://github.com/monad-crypto/token-list) repository. Please open a PR there rather than editing the package directly.
+
+## License
+
+MIT

npm/package.json

@@ -0,0 +1,91 @@
+{
+  "name": "@monad-crypto/token-list",
+  "version": "2.30.0",
+  "description": "Official Monad token list with full TypeScript types",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/monad-crypto/token-list.git",
+    "directory": "npm"
+  },
+  "homepage": "https://github.com/monad-crypto/token-list/tree/main/npm#readme",
+  "bugs": {
+    "url": "https://github.com/monad-crypto/token-list/issues"
+  },
+  "keywords": [
+    "monad",
+    "token-list",
+    "erc20",
+    "crypto",
+    "ethereum"
+  ],
+  "type": "module",
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "types": "./dist/esm/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/esm/index.d.ts",
+        "default": "./dist/esm/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/index.d.ts",
+        "default": "./dist/cjs/index.js"
+      }
+    },
+    "./mainnet": {
+      "import": {
+        "types": "./dist/esm/mainnet.d.ts",
+        "default": "./dist/esm/mainnet.js"
+      },
+      "require": {
+        "types": "./dist/cjs/mainnet.d.ts",
+        "default": "./dist/cjs/mainnet.js"
+      }
+    },
+    "./testnet": {
+      "import": {
+        "types": "./dist/esm/testnet.d.ts",
+        "default": "./dist/esm/testnet.js"
+      },
+      "require": {
+        "types": "./dist/cjs/testnet.d.ts",
+        "default": "./dist/cjs/testnet.js"
+      }
+    },
+    "./types": {
+      "import": {
+        "types": "./dist/esm/types.d.ts",
+        "default": "./dist/esm/types.js"
+      },
+      "require": {
+        "types": "./dist/cjs/types.d.ts",
+        "default": "./dist/cjs/types.js"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "clean": "rm -rf dist",
+    "codegen": "node scripts/codegen.mjs",
+    "build:esm": "tsc -p tsconfig.json",
+    "build:cjs": "tsc -p tsconfig.cjs.json",
+    "build": "npm run clean && npm run codegen && npm run build:esm && npm run build:cjs",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "typescript": "~5.7.0"
+  },
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  }
+}