npm, yarn and pnpm

This command writes the registry URL and a token to ~/.npmrc:

relic package setup npm npm --write

Install packages:

npm install

Publish a package:

npm publish

relic package setup pnpm and relic package setup yarn configure pnpm and Yarn.

To configure npm and pnpm by hand, add to .npmrc (or run npm login --registry https://relic.example.com/npm/npm/):

registry=https://relic.example.com/npm/npm/
//relic.example.com/npm/npm/:_authToken=<token>

Yarn 1 reads .npmrc too, but sends the token for unscoped packages only when always-auth is set for the registry. relic package setup yarn adds this line, which npm 11 warns it does not know:

//relic.example.com/npm/npm/:always-auth=true

For Yarn 2 and later, add to .yarnrc.yml:

npmRegistryServer: "https://relic.example.com/npm/npm"
npmAlwaysAuth: true
npmAuthToken: "<token>"

For a private CA (TLS), set cafile in .npmrc or NODE_EXTRA_CA_CERTS; Node ignores the system certificate store.

• A remote repository caches each packument for the metadata cache period (2 hours by default) and serves the cached one while the upstream is down or the repository is offline.
• npm login issues a token, described as npm login, that expires after 90 days. npm logout revokes it.
• npm dist-tag, npm deprecate and npm search work.
• npm unpublish removes a version, or the whole package, from the local repository (a virtual's default deployment repository) and needs the delete permission. The tarballs go to the trash can.
• npm audit asks the upstream of the repository's npm remote. Without a remote the server answers 503, and npm reports that the audit could not run.
• npm audit signatures gets the registry's signing keys (-/npm/v1/keys) and a version's attestations (-/npm/v1/attestations/<name>@<version>) from the upstream of the repository's npm remote. Without an online remote both answer 404. Packages published to Relic carry no registry signature.
• A tarball's npm tab shows its package.json, dependencies, license and install command.