npm package registry

Finluth serves scoped npm packages at https://git.finluth.com/api/packages/npm/. The @finluth scope is backed by the finluth/packages repository: users with read access can install packages, and users with write or admin access can publish.

Package metadata and tarballs are stored under .finluth/npm-packages, which is included in the existing data-directory backups. Published versions cannot be overwritten; publish a new version and move a dist-tag instead.

Configure npm or pnpm

Create a Git access token from your profile. Configure npm or pnpm with the scope and token (keep the token in a secret store, not in the repository):

@finluth:registry=https://git.finluth.com/api/packages/npm/
//git.finluth.com/api/packages/npm/:_authToken=${FINLUTH_NPM_TOKEN}

Then publish a scoped package with npm publish or pnpm publish. The package manifest can set publishConfig.registry to the Finluth endpoint.

Consumers install normally, for example npm install @finluth/logger; they need a token whose user has read access to finluth/packages. The registry supports npm-compatible metadata reads, tarball downloads, publishing, dist-tag reads and updates, and npm whoami.

See also the shared packages repository.