npm registry

The npm registry serves and accepts JavaScript packages for the npm, yarn, and pnpm clients. See README.md for the conventions shared by every registry protocol.

Resource overview

All endpoints are scoped to a repository and served under /npm/{owner}/{repo}/ on the API host (https://api.gitvetrix.com). Point a client at that base path to install from and publish to the repository's npm packages.

Auth & scopes

Reads are governed by repository visibility; publishing requires registry write. The credential is a session or access-token JWT sent as Authorization: Bearer <token> — npm clients read this from the _authToken setting in .npmrc. See Push scopes.

# .npmrc
@alice:registry=https://api.gitvetrix.com/npm/alice/app/
//api.gitvetrix.com/npm/alice/app/:_authToken=${VETRIX_TOKEN}

Endpoints

Method	Path	Summary
GET	/npm/{owner}/{repo}/{package}	Fetch package metadata (the packument)
GET	/npm/{owner}/{repo}/{package}/-/{tarball}	Download a version tarball
PUT	/npm/{owner}/{repo}/{package}	Publish a new version

GET /npm/{owner}/{repo}/{package}

Returns the packument: the package's known versions and dist-tags.

{
  "_id": "my-pkg",
  "name": "my-pkg",
  "versions": { "1.0.0": { "...": "..." }, "1.1.0": { "...": "..." } },
  "dist-tags": { "latest": "1.1.0" }
}

GET /npm/{owner}/{repo}/{package}/-/{tarball}

Downloads a version tarball ({package}-{version}.tgz) as application/octet-stream. The version is derived from the tarball filename.

PUT /npm/{owner}/{repo}/{package}

Publishes one or more versions. The body is the standard npm publish payload: a versions map and a base64-encoded _attachments map holding each version's .tgz. Returns 201 Created with { "ok": true }. This is the endpoint npm publish calls; invoke it through the client rather than by hand.

Example

npm install my-pkg --registry https://api.gitvetrix.com/npm/alice/app/
npm publish --registry https://api.gitvetrix.com/npm/alice/app/

Errors

Errors are JSON { "error": "<message>" } with the shared status-code conventions in errors.md: 401 (missing credential on publish, with a Bearer challenge), 403 (authenticated but not a writer), and 404 (unknown package, or a private repository the caller may not read).

Rate limits

Metered under the registry scope. See rate-limits.md.