Private registries
Route npm scopes to explicit HTTPS origins and keep bearer credentials out of project files.
Published v0.0.13 includes scoped private npm routing as a development feature. This is not full npm configuration compatibility or a production-support claim.
Configure a route
Put routing in the project-root tapid.toml:
url must be a canonical HTTPS origin. Paths, query strings, fragments and embedded credentials are rejected. token-env names an environment variable, not its value. Populate that variable through your protected local environment or the install job's CI secret configuration.
The example assumes that package exists at the configured origin and that the required environment variable is already present.
Routing and credential boundaries
Tapid selects the exact package scope, then the configured default, then the public npm registry. npm aliases route by their actual target name and scope. JSR packages retain their own registry identity.
Only the selected entry supplies credentials. A scope without token-env does not inherit a default token. A selected route requiring a missing or empty token fails without fallback. Without token-env, Tapid contacts the chosen origin without bearer authentication. Configure private scopes explicitly; an absent scope route can otherwise select the default or public registry.
Credentials attach only to the exact configured origin. Cross-origin redirects are rejected. Tapid does not read .npmrc, home-directory credentials or npm configuration variables implicitly. Registry tokens are excluded from root-script environments even if a run profile allowlists their names.
Replay and review
Offline and warm replay use pinned registry identities and verified trees without credentials or registry requests. Frozen hydration and tapid ci can download missing pinned artifacts, using credentials only for the selected configured origin. --offline forbids these downloads. Changed registry routing fails explicitly; it is not an identity-preserving lock migration. Preserve a verified backup of the previous lock before deliberately removing an incompatible lock and generating a replacement. Review every changed identity, version, digest and edge.
Keep tokens out of manifests, configuration values, lockfiles, arguments and copied logs. Read the tagged routing reference for the published implementation.