fix(add): the playground names the token its install needs

cmd/add/solution_playground.go

@@ -215,6 +215,14 @@ playground: remote
 
 .PHONY: remote
 remote:
+	@test -n "$$NODE_AUTH_TOKEN" || { \
+	  echo "NODE_AUTH_TOKEN is not set. The page's kits are published to GitHub"; \
+	  echo "Packages, so the install needs a token with read:packages:"; \
+	  echo ""; \
+	  echo "    export NODE_AUTH_TOKEN=\$$(gh auth token)"; \
+	  echo ""; \
+	  echo "Without it npm answers 401 Unauthorized and says nothing about why."; \
+	  exit 1; }
 	cd services/fe-remote && npm install --no-audit --no-fund && npm run build
 	test -f services/fe-remote/dist/mf-manifest.json
 `, titleFromName(name), name, name, playgroundDir)
@@ -223,6 +231,7 @@ remote:
 func playgroundReadme(name string) string {
 	return fmt.Sprintf(`# %s — the playground
 
+	export NODE_AUTH_TOKEN=$(gh auth token)   # read:packages, for the page's kits
 	make playground
 
 Then open the address the EDGE prints:
@@ -239,6 +248,13 @@ Then open the address the EDGE prints:
 | `+"`%s/backend`"+` | this solution's entry service |
 | `+"`%s/web`"+` | the shell that serves the page, mounting the same `+"`./Page`"+` a host federates |
 
+## The token
+
+The page's kits (@codefly-dev/*) are published to GitHub Packages, and
+services/fe-remote/.npmrc reads NODE_AUTH_TOKEN for them. Without it npm
+answers "401 Unauthorized - unauthenticated" and names no cause, so
+make playground refuses to start until it is set.
+
 ## The two addresses that are not it
 
 - **the shell's own port.** The page asks the edge for `+"`/auth/session`"+` on

cmd/add/solution_test.go

@@ -577,3 +577,21 @@ func TestThePlaygroundBuildsTheRemoteFirst(t *testing.T) {
 		}
 	}
 }
+
+// TestThePlaygroundRefusesWithoutTheRegistryToken. The page's kits are
+// published to GitHub Packages and the remote's .npmrc reads
+// NODE_AUTH_TOKEN, so without it npm answers "401 Unauthorized -
+// unauthenticated" and names no cause. The playground says so itself rather
+// than letting a newcomer meet that.
+func TestThePlaygroundRefusesWithoutTheRegistryToken(t *testing.T) {
+	makefile := playgroundMakefile("notes")
+	if !strings.Contains(makefile, "NODE_AUTH_TOKEN") {
+		t.Fatalf("the remote target must check for the registry token:\n%s", makefile)
+	}
+	if !strings.Contains(makefile, "gh auth token") {
+		t.Fatal("the refusal must name the command that sets it")
+	}
+	if !strings.Contains(playgroundReadme("notes"), "NODE_AUTH_TOKEN") {
+		t.Fatal("the playground README must state the token as a prerequisite")
+	}
+}

docs/commands.md

@@ -2435,9 +2435,20 @@ What it creates:
 `services/fe-remote` — the `./Page` remote itself — is written by the solution
 agent, not by this command: it is an npm package, not a Codefly service.
 
-**Running it.** `make playground` builds the page's remote, starts the
-development authority and this solution, and prints the one address a browser
-opens:
+**Running it.**
+
+```sh
+export NODE_AUTH_TOKEN=$(gh auth token)   # read:packages, for the page's kits
+make playground
+```
+
+The token is a prerequisite, not a nicety: the page's `@codefly-dev/*` kits are
+published to GitHub Packages and the remote's `.npmrc` reads it, so without one
+npm answers `401 Unauthorized - unauthenticated` and names no cause. The
+playground refuses to start and says which command sets it.
+
+`make playground` builds the page's remote, starts the development authority
+and this solution, and prints the one address a browser opens:
 
 ```
 edge listening on :14581, routing 1 module(s)