feat(registry): add .npmrc config support for custom registries and auth

- Integrate npmrc-config-rs to resolve registry URLs from .npmrc files
- Support scoped package registries (@Company:registry=...)
- Add authentication headers (Bearer tokens, Basic auth) for private registries
- Fallback to npm.jsr.io for @jsr/* packages when not explicitly configured
- Change UpdateUrl to carry package_name instead of full URL

Closes #220

Author: evaliyev

Cargo.lock

@@ -27,6 +27,7 @@ itertools = "0.14.0"
 lazy_static = "1.5.0"
 log = "0.4.29"
 node-semver = "2.2.0"
+npmrc-config-rs = "0.1.1"
 regex = { version = "1.12.2", default-features = false, features = ["std"] }
 reqwest = { version = "0.12", features = [
   "json",

Cargo.toml

@@ -23,14 +23,14 @@ use {
 #[path = "dependency_test.rs"]
 mod dependency_test;
 
-/// URL information for fetching package metadata from npm registry.
+/// Information for fetching package metadata from npm registry.
 /// Used by the update command to fetch available versions.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub struct UpdateUrl {
-  /// The name of the dependency
+  /// The name of the dependency as used in package.json
   pub internal_name: String,
-  /// Registry URL, e.g., "https://registry.npmjs.org/react"
-  pub url: String,
+  /// The actual npm package name (may differ from internal_name for aliases)
+  pub package_name: String,
 }
 
 /// All instances of a single dependency name within a version group.

src/dependency.rs

@@ -301,15 +301,16 @@ impl Instance {
         Specifier::Alias(alias) => {
           let aliased_name = &alias.name;
           if !aliased_name.is_empty() {
+            // JSR aliases are always fetched (they have their own namespace)
             if aliased_name.starts_with("@jsr/") {
               Some(UpdateUrl {
                 internal_name: internal_name.clone(),
-                url: format!("https://npm.jsr.io/{aliased_name}"),
+                package_name: aliased_name.clone(),
               })
             } else if aliased_name == actual_name {
               Some(UpdateUrl {
                 internal_name: internal_name.clone(),
-                url: format!("https://registry.npmjs.org/{actual_name}"),
+                package_name: aliased_name.clone(),
               })
             } else {
               debug!("'{aliased_name}' in '{raw}' does not equal the instance name '{actual_name}', skipping update as this might create mismatches");
@@ -320,17 +321,10 @@ impl Instance {
           }
         }
         Specifier::Exact(_) | Specifier::Range(_) | Specifier::Major(_) | Specifier::Minor(_) | Specifier::Latest(_) => {
-          if actual_name.starts_with("@jsr/") {
-            Some(UpdateUrl {
-              internal_name: internal_name.clone(),
-              url: format!("https://npm.jsr.io/{actual_name}"),
-            })
-          } else {
-            Some(UpdateUrl {
-              internal_name: internal_name.clone(),
-              url: format!("https://registry.npmjs.org/{actual_name}"),
-            })
-          }
+          Some(UpdateUrl {
+            internal_name: internal_name.clone(),
+            package_name: actual_name.clone(),
+          })
         }
         _ => None,
       }

src/instance.rs

@@ -36,47 +36,58 @@ fn returns_correct_registry_update_url() {
       .get_update_url()
   };
 
+  // Local packages should not have update URLs
   assert_eq!(get_update_url_by_name("local-package"), None);
+
+  // Direct JSR package
   assert_eq!(
     get_update_url_by_name("@jsr/luca__cases"),
     Some(UpdateUrl {
       internal_name: "@jsr/luca__cases".to_string(),
-      url: "https://npm.jsr.io/@jsr/luca__cases".to_string()
+      package_name: "@jsr/luca__cases".to_string()
     })
   );
+
+  // npm package with alias (aliased name matches actual name)
   assert_eq!(
     get_update_url_by_name("@lit-labs/ssr"),
     Some(UpdateUrl {
       internal_name: "@lit-labs/ssr".to_string(),
-      url: "https://registry.npmjs.org/@lit-labs/ssr".to_string()
+      package_name: "@lit-labs/ssr".to_string()
     })
   );
+
+  // Aliased JSR package - uses the JSR aliased name
   assert_eq!(
     get_update_url_by_name("@luca/cases"),
     Some(UpdateUrl {
       internal_name: "@luca/cases".to_string(),
-      url: "https://npm.jsr.io/@jsr/luca__cases".to_string()
+      package_name: "@jsr/luca__cases".to_string()
     })
   );
+
+  // More aliased JSR packages
   assert_eq!(
     get_update_url_by_name("@std/fmt"),
     Some(UpdateUrl {
       internal_name: "@std/fmt".to_string(),
-      url: "https://npm.jsr.io/@jsr/std__fmt".to_string()
+      package_name: "@jsr/std__fmt".to_string()
     })
   );
   assert_eq!(
     get_update_url_by_name("@std/yaml"),
     Some(UpdateUrl {
       internal_name: "@std/yaml".to_string(),
-      url: "https://npm.jsr.io/@jsr/std__yaml".to_string()
+      package_name: "@jsr/std__yaml".to_string()
     })
   );
+
+  // Regular npm package with alias
   assert_eq!(
     get_update_url_by_name("lit"),
     Some(UpdateUrl {
       internal_name: "lit".to_string(),
-      url: "https://registry.npmjs.org/lit".to_string()
+      package_name: "lit".to_string()
     })
   );
 }

src/instance_test.rs

@@ -70,16 +70,19 @@ async fn main() {
     len => debug!("Found {len} package.json files"),
   }
 
-  let ctx = Context::create(
-    config,
-    packages,
-    if is_update_command {
-      Some(Arc::new(LiveRegistryClient::new()))
-    } else {
-      None
-    },
-    catalogs,
-  );
+  let registry_client = if is_update_command {
+    match LiveRegistryClient::new() {
+      Ok(client) => Some(Arc::new(client) as Arc<dyn crate::registry_client::RegistryClient>),
+      Err(e) => {
+        error!("Failed to initialize registry client: {e}");
+        exit(1);
+      }
+    }
+  } else {
+    None
+  };
+
+  let ctx = Context::create(config, packages, registry_client, catalogs);
 
   let _exit_code = match ctx.config.cli.subcommand {
     Subcommand::Fix => {