Depending on a jsr package in a package published to npm

[fasttime]

We are planning on using a package that is only published to jrs (@std/path) as a dependency in a library that is published to both jsr and npm (@eslint/config-array). Is this use case supported?

My understanding is that npm requires a setting in the npm config file in order to resolve jsr packages (i.e. @jsr:registry=https://npm.jsr.io in .npmrc). But we can't enforce users to put that line in their .npmrc files before they install @eslint/config-array from npm. So, unless a user has already registered jsr in their global or user-specific npm config, the installation would fail if package.json specifies a dependency that cannot be resolved, i.e.:

"@jsr/std__path": "^1.0.2",

I couldn't find any help on how to get around this limitation at https://jsr.io/docs/using-packages, so we thought to ask here in case someone has already faced a similar problem.

[nzakas]

@lucacasonato can you help us out here?

[stefnotch]

I looked into this, and could not figure out a way of making this work at the moment.

The .npmrc file seems to not be the right tool for this.

There is an npm-accepted RFC for this https://github.com/npm/rfcs/blob/main/accepted/0035-registry-spec.md , but supposedly not even npm seems to implement it yet npm/statusboard#340
I also could not figure out whether pnpm and yarn have implemented this or not.

The avenues that I have not yet fully explored are

• https://docs.npmjs.com/cli/v11/using-npm/package-spec#tarballs
• Using an npm shrinkwrap file that points at a different registry https://docs.npmjs.com/cli/v11/configuring-npm/npm-shrinkwrap-json (or the package-lock setting?)
• Using a preinstall script to create the necessary .npmrc file.
• https://docs.npmjs.com/cli/v11/configuring-npm/package-json#publishconfig that sets a scope to point at a custom registry

[stefnotch]

I'll investigate this for a personal project in the future, do check out wgsl-tooling-wg/wesl-js#156 for any updates.