npm-publishlisted

# npm-publish — release create-cmp to the npm registry This repo publishes to npm as **`create-cmp-cli`** (not `create-cmp` — that name is an unrelated placeholder — and not `create-cmp-app` — that's a real, unrelated CMP generator). The installed *command* stays `create-cmp` regardless; `package.json` maps both `create-cmp` and `create-cmp-cli` as bin names so either invocation works. ## Auth — token-first, login fallback Publishing is unattended when a **granular npm access token** lives in Karel's `~/.npmrc`. The token is user-managed infrastructure, exactly like his SSH key or `gh` auth: the agent USES the ambient auth, it never sees, handles, stores, or moves the token itself. **Check auth before anything else:** ```bash npm whoami ``` - Prints a username → authed, proceed. Everything below runs without Karel in the loop. - Errors (`ENEEDAUTH`) → auth is missing/expired. STOP and tell Karel to refresh it (below). Do not attempt to work around it. **One-time token setup (Karel does this himself, not the agent):** 1. npmjs.com → avatar → **Access Tokens** → **Generate New Token** → **Granular Access Token** 2. Permissions: **Read and write**. Packages: only ours — every name under `packages/*/package.json` and `packages/aliases/*/package.json` (`node scripts/ground-truth.mjs` lists them; ten as of 2026-09-08, `prooflane-harness` and `prooflane-receipts` among them) — never "all packages". 3. Enable **Bypass two-factor authentication** (this is what makes pu