npm repositories work with the standard npm, yarn, and pnpm clients. The examples use the conventional names npm-proxy and npm-hosted.

Connecting to the proxy

Set the registry in .npmrc:

registry=https://<GALLEON_HOST>/repository/npm-proxy/
npm install lodash

Private packages from the hosted repository are wired by binding a scope to the registry — public packages keep coming through the proxy:

@myscope:registry=https://<GALLEON_HOST>/repository/npm-hosted/

If reading requires authentication, add the credential lines for the repository being read as well — following the example in the Publishing section, with the corresponding address.

Publishing

Add the hosted repository credentials to .npmrc — a username and password or the “Name code” and “Pass code” of a token (the password is base64-encoded):

//<GALLEON_HOST>/repository/npm-hosted/:username=<USERNAME>
//<GALLEON_HOST>/repository/npm-hosted/:_password=<base64(<PASSWORD>)>
//<GALLEON_HOST>/repository/npm-hosted/:email=you@example.com
//<GALLEON_HOST>/repository/npm-hosted/:always-auth=true
npm publish --registry https://<GALLEON_HOST>/repository/npm-hosted/

Published versions are immutable: re-publishing the same version is rejected.

Specifics

Format specifics:

  • Distribution tags (npm dist-tag add/rm/ls) are supported, but the latest tag cannot be moved manually — it is updated only by publishing.
  • npm deprecate works, including for already published versions.
  • Scoped packages (@scope/name) work in all clients.
  • Lock files record Galleon addresses — external registry links do not leak out.
←
Formats / Go
Formats / PyPI
→