npm

NORA provides a full npm-compatible registry. Publish private packages and transparently proxy public packages from the official npm registry.

Client Configuration

Point npm (or yarn/pnpm) at NORA:

# npm
npm config set registry http://nora.example.com:4000/npm/

# yarn
yarn config set registry http://nora.example.com:4000/npm/

# pnpm
pnpm config set registry http://nora.example.com:4000/npm/

Publish a package:

npm publish --registry http://nora.example.com:4000/npm/

Per-project .npmrc:

registry=http://nora.example.com:4000/npm/

Upstream Proxy

When a package is not found locally, NORA fetches it from the upstream registry. Tarball URLs in metadata are rewritten to point through NORA.

config.toml:

[npm]
enabled = true
proxy = "https://registry.npmjs.org"
proxy_timeout = 30
metadata_ttl = 300  # seconds

Environment variables:

Variable	Description	Default
NORA_NPM_ENABLED	Enable npm registry	true
NORA_NPM_PROXY	Upstream registry URL	https://registry.npmjs.org
NORA_NPM_PROXY_AUTH	Upstream auth (user:pass)	—
NORA_NPM_PROXY_TIMEOUT	Upstream timeout in seconds	30
NORA_NPM_METADATA_TTL	Metadata cache TTL in seconds	300

Features

Feature	Status	Notes
Package metadata (GET)	Full	JSON with all versions
Scoped packages (@scope/name)	Full	URL-encoded path
Tarball download	Full	SHA256 verified
Tarball URL rewriting	Full	Points to NORA, not upstream
Publish (npm publish)	Full	Immutable versions
Upstream proxy	Full	Configurable TTL
Unpublish	—	Not implemented
Dist-tags (latest, next)	Partial	Read from metadata, no explicit management
Search (/-/v1/search)	—	Not implemented
Audit advisories	—	Not implemented

Known Limitations

• No unpublish support — published versions are immutable.
• Dist-tags are read from upstream metadata but cannot be explicitly managed via NORA.
• Package search and security audit endpoints are not implemented.