npm-publishlisted

# npm-publish — release create-cmp to the npm registry This repo publishes to npm as **`create-cmp-cli`** (not `create-cmp` — that name is an unrelated placeholder — and not `create-cmp-app` — that's a real, unrelated CMP generator). The installed *command* stays `create-cmp` regardless; `package.json` maps both `create-cmp` and `create-cmp-cli` as bin names so either invocation works. ## Auth — token-first, login fallback Publishing is unattended when a **granular npm access token** lives in Karel's `~/.npmrc`. The token is user-managed infrastructure, exactly like his SSH key or `gh` auth: the agent USES the ambient auth, it never sees, handles, stores, or moves the token itself. **Check auth before anything else:** ```bash npm whoami ``` - Prints a username → authed, proceed. Everything below runs without Karel in the loop. - Errors (`ENEEDAUTH`) → auth is missing/expired. STOP and tell Karel to refresh it (below). Do not attempt to work around it. **One-time token setup (Karel does this himself, not the agent):** 1. npmjs.com → avatar → **Access Tokens** → **Generate New Token** → **Granular Access Token** 2. Permissions: **Read and write**. Packages: only ours — `create-cmp-cli`, `create-mobile`, `create-compose-multiplatform`, `create-kmp` — never "all packages". 3. Enable **Bypass two-factor authentication** (this is what makes publish non-interactive). 4. Pick an expiration; when it lapses, `npm whoami` starts failing and publish PUTs return E404 — tha