# npmjs.org auth — installing private `@x12i/*`

## Registry mapping

Scopes used by this package:

- `@x12i/xronox-store` (runtime dependency)
- `@x12i/xronox` (devDependency for types/tests)

Both are installed from **npmjs.org**, but may be **private**, so installs require an npm auth token with access to the `@x12i` org.

## `.npmrc` (repo root or user home)

Use the **double-slash** host form for the auth line (required by npm; a missing `//` causes bogus warnings like `Unknown env config "-authtoken"`).

```ini
@x12i:registry=https://registry.npmjs.org/
//registry.npmjs.org/:_authToken=${NPM_TOKEN}
always-auth=true
```

Or paste a classic npm token (never commit it):

```ini
//registry.npmjs.org/:_authToken=npm_xxxxxxxx
```

## Token permissions

The token must be allowed to install private packages in `@x12i`. (Some orgs also require 2FA and/or automation tokens for CI.)

## CI

In GitHub Actions, set a repository secret **`NPM_TOKEN`**, then write an `.npmrc` and run `npm ci`:

```bash
cp .npmrc.example .npmrc
echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> .npmrc
npm ci
```

Use a repository secret **`NPM_TOKEN`** with access to `@x12i` private packages.

See [`.github/workflows/ci.yml`](../.github/workflows/ci.yml).

## Verify

```bash
npm view @x12i/xronox-store version
```

If this hits the public npm registry and 404s, your `.npmrc` is not applying the scope → fix registry lines above.