id       = "npmrc"
name     = "npmrc"
homepage = "https://github.com/deoxxa/npmrc"
description = "Switch between different .npmrc files with ease and grace."
# The repository's own description, verbatim.
executables   = ["npmrc"]

[dotfiles]

# npmrc has no configuration of its own: what it manages is a store of whole
# .npmrc files, and everything about its behaviour comes from the command line
# and two environment variables. The store is the credential below.
paths = []

exclude = []

# README: "Calling npmrc without arguments creates an ~/.npmrcs/ directory if
# it doesn't exist, and copies your current ~/.npmrc as the 'default' .npmrc
# profile", and switching profiles replaces ~/.npmrc with the named one
# ($NPMRC_STORE moves the directory, $NPMRC moves the active file).
#
# Every file in that directory is a complete .npmrc, and the reason to keep a
# second one is nearly always a second registry that needs its own token —
# npmrc's own README frames profiles around pointing npm at a non-default
# registry. The `npm` entry already records what that looks like inside a
# .npmrc: auth lines keyed by registry URL, every one of them starting with
# `//`, e.g. `//npm.pkg.github.com/:_authToken=…`.
#
# The store is classified as a credential rather than as content because no
# rule here can reach inside it: a secret_paths rule names one concrete file,
# and every profile name except `default` is the user's own invention, so
# `//` could only ever be carved out of one of them. Over-classifying costs a
# consumer the registry URLs; under-classifying publishes the tokens. A
# consumer that wants the non-auth half back can apply the `npm` entry's `//`
# rule to each file in this directory itself.
#
# ~/.npmrc, the file npmrc swaps in and out, belongs to the `npm` entry.
secret = ["~/.npmrcs/"]