npm and registries
Lesson 1 of 10 · 2 minutes
https://privatenpm.com/guides/private-npm-registry

00:00  Follow one private installation
Where does npm get a private package? Let us follow one installation, from the client to the registry and the package files. npm is a command-line client for JavaScript packages.

00:14  A name and a version
A version identifies one package release. In @acme/sdk, @acme is the scope. The scope is a name prefix. A scoped package can be public.

00:28  Metadata and package files
The registry keeps metadata and package files. Metadata gives the versions, dependencies, tarball URL, and integrity value. A dependency is another package that the code uses. A tarball is an archive of the package files.

00:43  Route the scope
Use .npmrc to route the Acme scope to your private registry. Other names use the default registry, unless another scope route applies. This configures the client. It does not give package access.

01:01  Control package access
The registry authenticates the request. It authorizes access to each package. A download key gives read access to the packages in its access rules. It cannot publish. Keep the secret in an environment variable.

01:15  Resolve, download, compare
Without a lockfile, npm selects versions and dependencies from metadata. It downloads the tarballs and does an integrity check. The key must give access to each private dependency.

01:34  Keep the dependency tree
The lockfile records exact versions and integrity values. Commit the lockfile with the project. Use npm ci to install from it. npm ci stops if the dependency declarations and lockfile do not agree.

01:50  Name. Route. Access. Files.
Does a scope control package access? No. The registry controls access. Next, configure scopes and registry routes.