Two ruleset packages advertise npm but are not published

[kinlane]

Two ruleset packages are not on npm, while their READMEs and the registry offer npm as an adoption route:

Package	npm
@api-common/spectral-owasp-ruleset	✅ published
@api-common/api-governance-mcp	✅ published
@api-common/spectral-problem-details-ruleset	❌ 404
@api-common/spectral-fhir-ruleset	❌ 404

Adoption by extends against the raw GitHub URL works today and is what the READMEs lead with, so nothing is broken. But npm i -D @api-common/spectral-fhir-ruleset fails, and both package.json files declare publishConfig.access: public as though publication were intended.

Before publishing

Both packages now declare "license": "CC-BY-NC-SA-4.0 AND Apache-2.0". Worth a deliberate look at what that means on a public registry — npm surfaces the license prominently, and NonCommercial on a governance ruleset is a real constraint for the commercial teams most likely to install it. That tension is known and was accepted as policy; publishing to npm is where it becomes most visible.

Either publish both, or drop the npm route from the READMEs and the registry adoptVia so the only advertised path is the one that works.