X_TRUST_2FA_REQUIRED
Means
npm refused the trust change on the credential's class
Typical cause
a granular access token that bypasses two-factor auth — attaching a publisher is an account-level trust change, so npm requires a session that carries 2FA, and no OTP flag rescues a bypass token
Fix
npm login, then bun run scripts/trust-publishers.ts