feat(registry): add .npmrc config support for custom registries and auth

Add npmrc-config-rs integration for scoped registries, credential
resolution, and multi-layer config priority in LiveRegistryClient.

Include 26 integration tests covering resolve_url, credentials,
config loading priority, API surface, and platform behavior.
Make existing registry_client tests deterministic with isolated
tempfile-based config instead of host-dependent ~/.npmrc.

Author: evaliyev

Cargo.lock

@@ -13,6 +13,7 @@ include = ["src/**/*.rs"]
 
 [dev-dependencies]
 ctor = "0.6.3"
+tempfile = "3"
 
 [dependencies]
 async-trait = "0.1.89"
@@ -27,6 +28,7 @@ itertools = "0.14.0"
 lazy_static = "1.5.0"
 log = "0.4.29"
 node-semver = "2.2.0"
+npmrc-config-rs = "0.1.1"
 regex = { version = "1.12.3", default-features = false, features = ["std"] }
 reqwest = { version = "0.12", features = [
   "json",

Cargo.toml

@@ -1,10 +1,6 @@
 use {
-  crate::{
-    commands::{ui, ui::LINE_ENDING},
-    context::Context,
-    version_group::VersionGroupVariant,
-  },
-  log::{error, warn},
+  crate::{commands::ui, context::Context, version_group::VersionGroupVariant},
+  log::error,
 };
 
 pub fn run(ctx: Context) -> i32 {
@@ -50,9 +46,6 @@ pub fn run(ctx: Context) -> i32 {
     ctx.failed_updates.iter().for_each(|name| {
       error!("Failed to fetch {name}");
     });
-    warn!(
-      "Syncpack does not yet support custom npm registries{LINE_ENDING}  Subscribe to https://github.com/JamieMason/syncpack/issues/220"
-    );
   } else if !was_outdated {
     ui::util::print_no_issues_found();
   }

src/commands/update.rs

@@ -23,14 +23,14 @@ use {
 #[path = "dependency_test.rs"]
 mod dependency_test;
 
-/// URL information for fetching package metadata from npm registry.
+/// Information for fetching package metadata from npm registry.
 /// Used by the update command to fetch available versions.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub struct UpdateUrl {
-  /// The name of the dependency
+  /// The name of the dependency as used in package.json
   pub internal_name: String,
-  /// Registry URL, e.g., "https://registry.npmjs.org/react"
-  pub url: String,
+  /// The actual npm package name (may differ from internal_name for aliases)
+  pub package_name: String,
 }
 
 /// All instances of a single dependency name within a version group.

src/dependency.rs

@@ -301,15 +301,10 @@ impl Instance {
         Specifier::Alias(alias) => {
           let aliased_name = &alias.name;
           if !aliased_name.is_empty() {
-            if aliased_name.starts_with("@jsr/") {
+            if aliased_name.starts_with("@jsr/") || aliased_name == actual_name {
               Some(UpdateUrl {
                 internal_name: internal_name.clone(),
-                url: format!("https://npm.jsr.io/{aliased_name}"),
-              })
-            } else if aliased_name == actual_name {
-              Some(UpdateUrl {
-                internal_name: internal_name.clone(),
-                url: format!("https://registry.npmjs.org/{actual_name}"),
+                package_name: aliased_name.clone(),
               })
             } else {
               debug!("'{aliased_name}' in '{raw}' does not equal the instance name '{actual_name}', skipping update as this might create mismatches");
@@ -320,17 +315,10 @@ impl Instance {
           }
         }
         Specifier::Exact(_) | Specifier::Range(_) | Specifier::Major(_) | Specifier::Minor(_) | Specifier::Latest(_) => {
-          if actual_name.starts_with("@jsr/") {
-            Some(UpdateUrl {
-              internal_name: internal_name.clone(),
-              url: format!("https://npm.jsr.io/{actual_name}"),
-            })
-          } else {
-            Some(UpdateUrl {
-              internal_name: internal_name.clone(),
-              url: format!("https://registry.npmjs.org/{actual_name}"),
-            })
-          }
+          Some(UpdateUrl {
+            internal_name: internal_name.clone(),
+            package_name: actual_name.clone(),
+          })
         }
         _ => None,
       }

src/instance.rs

@@ -36,47 +36,57 @@ fn returns_correct_registry_update_url() {
       .get_update_url()
   };
 
+  // Local packages should not have update URLs
   assert_eq!(get_update_url_by_name("local-package"), None);
+
+  // Direct JSR package
   assert_eq!(
     get_update_url_by_name("@jsr/luca__cases"),
     Some(UpdateUrl {
       internal_name: "@jsr/luca__cases".to_string(),
-      url: "https://npm.jsr.io/@jsr/luca__cases".to_string()
+      package_name: "@jsr/luca__cases".to_string()
     })
   );
+
+  // npm package with alias (aliased name matches actual name)
   assert_eq!(
     get_update_url_by_name("@lit-labs/ssr"),
     Some(UpdateUrl {
       internal_name: "@lit-labs/ssr".to_string(),
-      url: "https://registry.npmjs.org/@lit-labs/ssr".to_string()
+      package_name: "@lit-labs/ssr".to_string()
     })
   );
+
+  // Aliased JSR package - uses the JSR aliased name
   assert_eq!(
     get_update_url_by_name("@luca/cases"),
     Some(UpdateUrl {
       internal_name: "@luca/cases".to_string(),
-      url: "https://npm.jsr.io/@jsr/luca__cases".to_string()
+      package_name: "@jsr/luca__cases".to_string()
     })
   );
+
   assert_eq!(
     get_update_url_by_name("@std/fmt"),
     Some(UpdateUrl {
       internal_name: "@std/fmt".to_string(),
-      url: "https://npm.jsr.io/@jsr/std__fmt".to_string()
+      package_name: "@jsr/std__fmt".to_string()
     })
   );
   assert_eq!(
     get_update_url_by_name("@std/yaml"),
     Some(UpdateUrl {
       internal_name: "@std/yaml".to_string(),
-      url: "https://npm.jsr.io/@jsr/std__yaml".to_string()
+      package_name: "@jsr/std__yaml".to_string()
     })
   );
+
+  // Regular npm package with alias
   assert_eq!(
     get_update_url_by_name("lit"),
     Some(UpdateUrl {
       internal_name: "lit".to_string(),
-      url: "https://registry.npmjs.org/lit".to_string()
+      package_name: "lit".to_string()
     })
   );
 }