npm granular tokens cannot scope a package that is not yet published

A granular access token is scoped by picking specific packages from a list, so it cannot target a package whose first version has never been published. For an initial publish the only granular option is All packages, which is broader than intended; a classic Automation token bypasses 2FA and works on unpublished names, so it is the narrower practical choice for a first release. Re-scope or replace the token after the package exists.