npm publish 403 means 2FA, and fresh versions lag in cache

npm publish failing with E403 "Two-factor authentication or granular access token with bypass 2fa enabled is required" means the account has no 2FA; enable it on npmjs.com, then publish again (security keys/passkeys trigger a browser approval, apps need --otp). Right after publishing, npm view may show the new version while npm pack/install still says notarget because the local packument cache is stale; use --prefer-online to verify the published tarball.