CONTRIBUTING.md

@@ -26,8 +26,9 @@ The standard [pre-commit](https://pre-commit.com) route is available as well, an
 [SheetJS Pro Version](https://www.npmjs.com/package/sheetjs)
 
 
-To auth for SheetJS Pro version you need to use their private registry
-Add `client/.npmrc` file with following content:
+To auth for SheetJS Pro version you need to use their private registry. Keep that config out of
+the repo - `client/.npmrc` is tracked and holds policy only (see below). Put the registry auth in
+your user config, `~/.npmrc`:
 ```
 @sheet:registry=https://pylon.sheetjs.com:54111/
 //pylon.sheetjs.com:54111/:_authToken="TOKEN-GOES-HERE"
@@ -49,9 +50,8 @@ npm i
 npm run postinstall
 ```
 
-The root and `sas/` `.npmrc` files set `ignore-scripts=true` too, so the composite `install`
-script in the root `package.json` (which installs both subprojects) does not run on `npm i` at the
-root. Install each part explicitly:
+The root and `sas/` `.npmrc` files set `ignore-scripts=true` too, and the root `package.json`
+carries no install script - the root install is `npm ci` plus the subprojects, each run explicitly:
 
 ```bash
 npm ci              # root tooling: gitleaks, prettier, semantic-release

client/.npmrc

@@ -2,4 +2,4 @@ ignore-scripts=true
 save-exact=true
 # dependency install hooks are skipped: the client's own postinstall generates
 # src/environments/version.ts and the hot icons, so run `npm run postinstall`
-# after installing (the root install script does this for you)
+# after installing - see CONTRIBUTING.md for the full sequence