npm-upload-test

Publishing (organizational best practice)

Authentication uses environment-based tokens so secrets are never committed.

1. Get a token from npm (Account → Access Tokens) or your org’s token process. Prefer granular/automation tokens with minimal scope (e.g. publish only).
2. Local publish: set the token in your environment, then publish:

   export NPM_TOKEN=your_token_here
   npm publish

3. CI/CD: store the token as a secret (e.g. NPM_TOKEN) in your pipeline and ensure the pipeline sets that env var before running npm publish.

The project .npmrc reads NPM_TOKEN; the token itself must never be committed.