diff --git a/.github/workflows/npm.yml b/.github/workflows/npm.yml
new file mode 100644
index 0000000..6329f5a
--- /dev/null
+++ b/.github/workflows/npm.yml
@@ -0,0 +1,37 @@
+name: Publish NPM
+
+on:
+  push:
+    tags:
+      - v/*
+
+jobs:
+
+  publish:
+
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: v20
+          registry-url: https://registry.npmjs.org/
+
+      - uses: denoland/setup-deno@v1
+        with:
+          deno-version: v1
+
+      - name: Build the pkg
+        run: deno task build-npm
+
+      - name: Publish to npm
+        run: npm publish --tag=latest --access=public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+
diff --git a/deno.json b/deno.json
index 2c7ab72..c16d080 100644
--- a/deno.json
+++ b/deno.json
@@ -15,6 +15,9 @@
     "./main": "./src/cli/main.ts",
     ".": "./src/cli/bin.ts"
   },
+  "tasks": {
+    "build-npm": "./tools/build-npm.ts"
+  },
   "compilerOptions": {
     "strict": true,
     "noImplicitAny": true,
diff --git a/tmp-package.json b/tmp-package.json
new file mode 100644
index 0000000..7e34945
--- /dev/null
+++ b/tmp-package.json
@@ -0,0 +1,25 @@
+{
+  "name": "pkg-fence",
+  "version": "0.0.0-VERSION",
+  "description": "tbd",
+  "license": "AGPL-3.0-or-later",
+  "repository": {
+    "url": "https://github.com/imcotton/pkg-fence.git",
+    "type": "git"
+  },
+  "bin": "./dist/cli/bin.js",
+  "exports": {
+    "./main": "./dist/cli/main.js"
+  },
+  "files": [
+    "./dist/cli/bin.js",
+    "./dist/cli/main.js",
+    "./LICENSE.txt",
+    "./README.md"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  }
+}
diff --git a/tools/build-npm.ts b/tools/build-npm.ts
new file mode 100644
index 0000000..d7e796c
--- /dev/null
+++ b/tools/build-npm.ts
@@ -0,0 +1,85 @@
+#!/usr/bin/env -S deno run -A
+
+import * as esbuild from 'https://deno.land/x/esbuild@v0.23.0/mod.js';
+
+import * as fs from 'jsr:@std/fs@~0.229.3';
+
+import pkg from '../deno.json' with { type: 'json' };
+
+
+
+
+
+{ // package.json
+
+    const txt = await Deno.readTextFile('./tmp-package.json');
+    const content = txt.replace('0.0.0-VERSION', pkg.version);
+
+    const output = './package.json';
+    await Deno.writeTextFile(output, content, { create: true });
+
+}
+
+
+
+
+
+const outdir = './dist/cli';
+
+await fs.ensureDir(outdir);
+
+
+
+
+
+{ // the main file
+
+    const files = await esbuild.build({
+
+        outdir,
+        entryPoints: [
+            './src/cli/main.ts',
+        ],
+        write: false,
+        bundle: true,
+        format: 'esm',
+        platform: 'node',
+        target: [ 'node18', 'es2022' ],
+        supported: {
+            'node-colon-prefix-import': true,
+        },
+
+    });
+
+    for (const { path, text } of files.outputFiles) {
+
+        // https://esbuild.github.io/faq/#top-level-var
+        // const would be fine here
+        const content = text.replaceAll(/^var /gm, 'const ');
+
+        await Deno.writeTextFile(path, content, { create: true });
+
+    }
+
+}
+
+
+
+
+
+{ // the bin file
+
+    const txt = await Deno.readTextFile('./src/cli/bin.ts');
+    const content = txt.replace('main.ts', 'main.js');
+
+    const output = `${ outdir }/bin.js`;
+    await Deno.writeTextFile(output, content, { create: true });
+
+}
+
+
+
+
+
+await esbuild.stop();
+