Install npm packages

Sign in once, then let rvs select the registry URL and provide temporary authentication to npm.

Install through rvs

Select the Ravenstash repository, then use npm through rvs:

rvs art select platform/releases
rvs npm install @acme/design-system

Authentication is limited to the child process rather than written to .npmrc.

Public dependencies through a private mirror

When the repository uses an npmjs.org mirror, eligible public dependencies resolve through the same private target. Security scanning, minimum package age, and caching protect that path without adding a second registry to project files. One source also avoids the dependency-confusion risk of letting npm choose between a private registry and npmjs.org.

A private package name takes priority over the same name on npmjs.org. To reserve a whole scope, such as @acme/*, add a package resolution rule.

pnpm

rvs pnpm runs pnpm 9 to 12 with temporary access, like rvs npm:

rvs pnpm install --frozen-lockfile
rvs pnpm add @acme/design-system

The selected repository is used even when the project’s .npmrc or pnpm-workspace.yaml names another registry. Ravenstash serves npm’s own tarball addresses, so pnpm-lock.yaml does not name your Ravenstash repository and works with any registry the project later uses.

pnpm 11 and later skip versions published less than a day ago when they resolve a range or latest (their minimumReleaseAge setting). Install a version you just published by its exact version, or set minimumReleaseAge in pnpm-workspace.yaml.

If package.json pins another pnpm version in packageManager, pnpm downloads that version from your repository; rvs warns before it runs. Run the pinned pnpm version instead.

Yarn and Bun

rvs does not include Yarn or Bun commands. Use rvs npm or rvs pnpm for the simplest setup. If your project requires another client, follow temporary credential setup and test the exact client version before using it in CI.

Tip

If a client returns 401, run rvs status and confirm the selected account and repository.

Use npm-compatible clients directly

To run plain npm install, or configure pnpm, Yarn, or Bun without a wrapper, mint a short-lived read token:

RVS_NATIVE_TOKEN=$(rvs art token mint \
  --target platform/releases \
  --format npm \
  --access read)
export RVS_NATIVE_TOKEN

Print the current addresses or generate a complete read-only npm recipe:

rvs art endpoint --target platform/releases --format npm
rvs art native config npm --target platform/releases --access read

endpoint only prints addresses. native config prints .npmrc and command examples without writing files, minting a token, or running npm.

Copy the current download address from Ravenstash, then add the registry and an environment reference to .npmrc:

.npmrc

registry=https://npm.rvsta.sh/platform/releases/
//npm.rvsta.sh/platform/releases/:_authToken=${RVS_NATIVE_TOKEN}

npm install your-package

pnpm, Yarn, and Bun can use the same npm-compatible registry configuration. Test the exact client version used by your project before adopting it in CI.

Do not commit a resolved token value to .npmrc. Commit only the environment reference when project policy permits it, or provide these entries through a temporary user configuration in CI. See Use tokens with package tools for expiry, access, and rotation details.