Run native registry tools through rvs

rvs wraps the native tools developers already use. It supplies eligible Ravenstash authentication to the child process without writing the token to persistent package-manager configuration.

Supported wrappers

Command	Native tool	Target support
rvs pip	pip	Private PyPI repository or mirror
rvs uv	uv	Private PyPI repository or mirror
rvs twine	Twine	Private PyPI repository only
rvs npm	npm	Private npm repository or mirror for reads
rvs mvn	Maven	Private Maven repository or mirror for reads
rvs docker	Docker	Private Container repository only
rvs helm	Helm	Private Helm OCI repository only
rvs oras	ORAS	Private Container or Helm repository only

Arguments after the rvs options are passed to the native tool:

rvs pip install internal-sdk==1.2.3
rvs uv sync --frozen
rvs twine upload dist/*
rvs npm ci
rvs mvn verify

The corresponding program must be available. rvs runtime can provide Python with pip or Node.js with npm; install uv, Twine, Maven, Docker, Helm, and ORAS separately when needed.

Select a repository or mirror

Select the destination once, then keep everyday package commands concise:

rvs art select platform/packages
rvs pip install internal-sdk
rvs npm install @acme/design-system
rvs mvn test

Private mirrors use the same pattern:

rvs art mirror select pypiorg
rvs pip install requests

rvs art mirror select npmjs
rvs npm install lodash

rvs art mirror select --custom company-maven
rvs mvn test

When several profiles or accounts are available, use the intended ones before selecting the target:

rvs profile use company
rvs account use org:acme
rvs art select platform/packages
rvs npm ci

Control native configuration

Package-manager wrappers accept --rvs-native-config:

Policy	Behavior
respect	Default. Preserve native configuration and add authentication when a Ravenstash route is selected or detected.
override	Select the Ravenstash target for this invocation while retaining other usable native settings.
isolate	Disable persistent native configuration where supported and use invocation-specific Ravenstash settings.

For example:

rvs art select platform/packages
rvs uv --rvs-native-config isolate sync --frozen

Use respect for normal development. Reserve isolate for deliberate reproducibility checks.

Docker, Helm, and ORAS

Select a private repository, then use a short image name for Docker push, pull, and tag. Helm accepts short chart paths; ORAS uses full references:

rvs art select platform/runtime-images
rvs docker pull api:latest

rvs art select platform/deployment-charts
rvs helm show chart charts/api --version 1.2.3

rvs art select platform/runtime-images
rvs oras --rvs-kind container \
  discover oci.rvsta.sh/platform/runtime-images/api:latest

Container and Helm share oci.rvsta.sh but remain distinct registry kinds. ORAS therefore requires --rvs-kind container|helm. Private-mirror targets are rejected for all OCI wrappers.

Docker pulls retain the full local image name; pushes add the full destination tag automatically and reject conflicting local tags. Buildx output tags and Dockerfile references stay explicit. See Container workflows for mixed public/private builds and tagging rules.

Security behavior

Package-manager credentials are limited to the wrapper process environment or temporary configuration created for the invocation. OCI wrappers use a temporary copy of native registry configuration and preserve unrelated registry credentials. rvs does not persist a token in .npmrc, pip.conf, .pypirc, settings.xml, pyproject.toml, uv.toml, or the user’s Docker or Helm configuration.

Native tools can still display URLs or environment details in verbose debugging. Inspect logs before sharing them and rotate any credential that appears in output.