feat: read registry and credentials from .npmrc using @npmcli/config

[Copilot]

Summary

When no registry is specified via CLI (--registry / -r) or config file (beachball.config.js), beachball now lazily resolves the registry and credentials from .npmrc files using @npmcli/config before npm operations, falling back to the default https://registry.npmjs.org/.

This resolution is lazy — it only happens when the registry and token are actually needed (e.g., during publish, canary, sync, or init), not during initial options parsing. Results are cached per cwd for efficiency.

Lookup order

1. CLI --registry flag (highest priority)
2. Config file registry setting
3. .npmrc files resolved via @npmcli/config (project-level, user-level, global, environment variables)
4. Default: https://registry.npmjs.org/

Auth credentials (e.g., _authToken) are also read from .npmrc via @npmcli/config's getCredentialsByURI() when available. Explicit --token / NPM_TOKEN values take precedence over .npmrc credentials.

Changes

• New dependency: @npmcli/config — Used to read npm config from all standard sources with full environment variable substitution and credential support.
• New file: src/packageManager/npmConfig.ts — getNpmConfig(cwd) loads npm config lazily and caches results. resolveNpmConfig(options) resolves registry and auth token on the options object, returning a type-narrowed result with registry: string.
• Modified: src/types/BeachballOptions.ts — registry is now optional in RepoOptions.
• Modified: src/options/getDefaultOptions.ts — Removed registry default (resolved lazily instead).
• Modified: src/options/getOptions.ts — Removed .npmrc fallback from mergeRepoOptions (resolution is now lazy).
• Modified: commands (publish.ts, canary.ts, sync.ts, init.ts) — Added resolveNpmConfig() calls before npm operations.
• Modified: src/publish/publishToRegistry.ts — Parameter type narrowed to require registry: string.
• Modified: src/packageManager/npmAuthEnvPassthrough.ts — Updated parameter type to use inline { registry: string; path: string }.
• Deleted: src/packageManager/npmrc.ts — Replaced by npmConfig.ts.
• Updated: docs/overview/configuration.md — Updated docs for the registry option.
• New tests: Functional tests for getNpmConfig and resolveNpmConfig (including env var substitution and credential reading). Updated existing tests and snapshots for the optional registry type change.

[ecraig12345]

@copilot When reading the npmrc, add environment variable substitution support similar to @npmcli/config

[Copilot]

@copilot When reading the npmrc, add environment variable substitution support similar to @npmcli/config

Added ${VAR_NAME} substitution support in commit 01bc97f. The implementation matches @npmcli/config behavior: ${VAR} is replaced with the env var value, unset variables resolve to empty string, and bare $VAR (without braces) is left as-is.

[ecraig12345]

@copilot Update the PR (and description) to use @npmcli/config, and read both the registry and credentials. Since this is more expensive, it should only be done when the registry and token are needed, not during initial options parsing (but the result should be saved somewhere). To ensure correct behavior, the registry default of the public npm registry should be removed from getDefaultOptions, and registry should be marked as optional in BeachballOptions.

[Copilot]

@copilot Update the PR (and description) to use @npmcli/config, and read both the registry and credentials. Since this is more expensive, it should only be done when the registry and token are neede...

Done in 88b6d92. Key changes:

• Replaced custom .npmrc parsing with @npmcli/config in new src/packageManager/npmConfig.ts
• getNpmConfig(cwd) reads registry + credentials via getCredentialsByURI(), results cached per cwd
• resolveNpmConfig(options) lazily resolves registry and token before npm operations (not during initial parsing)
• registry is now optional in RepoOptions/BeachballOptions, removed from getDefaultOptions
• Added resolveNpmConfig calls at the start of publish, canary, sync, and init commands
• Return type of resolveNpmConfig narrows registry to string for downstream type safety

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• ofcncog2cu-dsn.algolia.net
  • Triggering command: /usr/local/bin/node /usr/local/bin/node /home/REDACTED/work/beachball/beachball/.yarn/releases/yarn-4.14.1.cjs add @npmcli/config@^10.9.0 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)