Prepare the registry identity

Before choosing a tool or writing more code, make the requirement concrete. The scoped utility has explicit public access, multiple maintainers where appropriate, and a protected npm account.

Publishing changes an immutable public namespace, so package and maintainer identity deserve the same care as code. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

A common failure is to discover the active registry and account only after running the publish command. The happy path may still work, which makes the mistake easy to miss. verify registry, login identity, package name, access level, owners, two-factor or trusted publishing, and recovery details. Keep the first version small enough that every important input and output remains visible.

This supports the module goal: Publish an intentional immutable artifact with strong account controls and a release record you can verify. Capture the request, command, trace, screenshot, test result, or other evidence that proves the result.

Run the read-only identity and package checks from a clean shell and save a release checklist without tokens. Change one condition on purpose, predict the result, and compare the prediction with what actually happened.