⚠️ Potential issue | 🟠 Major

Add always-auth=true so npm actually sends the token.

Artifact Registry’s own guidance keeps an always-auth=true entry alongside the _authToken. Without it, npm can skip attaching the token on preliminary GET/HEAD requests when publishing, which leads to intermittent 401s during npm publish. Please add the flag when building .npmrc.(cloud.google.com)

           TOKEN=$(gcloud auth print-access-token)
           rm -rf .npmrc
-          echo -e "\n//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:_authToken=\"$TOKEN\"" >> .npmrc
+          echo -e "\n//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:always-auth=true" >> .npmrc
+          echo "//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:_authToken=\"$TOKEN\"" >> .npmrc
           echo "@spotdraft:registry=https://asia-south1-npm.pkg.dev/spotdraft-qa/npm/" >> .npmrc

In .github/workflows/master.yaml around lines 35 to 40, the workflow writes an
.npmrc with the _authToken and registry but omits the always-auth flag; update
the script that builds .npmrc to append an always-auth=true entry (for the
registry in question) immediately after writing the _authToken so npm will
always send the token and avoid intermittent 401s during publish.

⚠️ Potential issue | 🔴 Critical

Fix _authToken quoting to avoid authentication failure.

.npmrc keeps the double quotes you echo around ${TOKEN}, so npm sends Bearer "token" and Artifact Registry rejects the publish (dry-run or real). Drop the quotes and write the file in one shot.

-          TOKEN=$(gcloud auth print-access-token)
-          rm -rf .npmrc
-          echo -e "\n//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:_authToken=\"$TOKEN\"" >> .npmrc
-          echo "@spotdraft:registry=https://asia-south1-npm.pkg.dev/spotdraft-qa/npm/" >> .npmrc
+          TOKEN="$(gcloud auth print-access-token)"
+          cat <<'EOF' > .npmrc
+//asia-south1-npm.pkg.dev/spotdraft-qa/npm/:_authToken=${TOKEN}
+@spotdraft:registry=https://asia-south1-npm.pkg.dev/spotdraft-qa/npm/
+EOF

Committable suggestion skipped: line range outside the PR's diff.

In .github/workflows/pr.yaml around lines 37 to 40, the current echo adds
literal double quotes around the auth token and appends each line separately;
change it to write the .npmrc in a single write operation and remove the
surrounding quotes so the _authToken is written as ...:_authToken=<TOKEN> (no
quotes). Ensure the command writes both registry lines to .npmrc atomically
(overwrite, not append) and that the token is inserted raw so npm sends Bearer
<token> without embedded quotes.

renaming the package to @spotdraft/liquidjs while the publish workflow only authenticates/publishes to the scoped registry means npm install liquidjs stops receiving updates yet README/install docs still point to the unscoped name; can we keep publishing an alias named liquidjs or explicitly document the new scoped package before the contract is broken?

_{Finding type: Breaking Changes}

PR workflow now sets node-version: '24' while the master publish workflow still uses Node 20, so the dry-run on PRs no longer validates the actual publish environment and Node 20–specific build/publish regressions can slip through; can we pin the same Node version in both workflows?

_{Finding type: Logical Bugs}

echo -e "..._authToken="$TOKEN"" expands the freshly minted GCP access token inside the logged shell command, so the raw token is emitted in every workflow log (same lines exist in pr.yaml); can we mask the token (e.g. echo "::add-mask::$TOKEN") or otherwise avoid printing the value when writing .npmrc?

_{Finding type: Basic Security Patterns}