/pkg /target /node_modules Cargo.lock # npm auth token — per-project, never commit .npmrc