And surely they should accommodate controlling the ENV of that build process as well?

Perhaps by doing things like setting NPM_TOKEN for the correct account?

Just like you would with CI?

... except they claim that's too hard.