Publishing to the Gitea npm registry needs an _authToken, and the natural
place to put it is a .npmrc in the repo root — which was not ignored. The
committed .npmrc.example invites exactly that mistake.
The pattern matches the exact filename, so .npmrc.example is unaffected.
Nothing was leaked: no .npmrc has ever been committed here. This is
preventative.
Better still, publish with `npm publish --userconfig <path outside the
repo>` and keep the token out of the working tree entirely — that is how
v0.5.0 was published.
Co-Authored-By: Claude Opus 5 <[email protected]>