Skip to main content

Package access

TradeScript gives each deployment its own private npm package. Your TradeScript contact provides these three values after the distribution is built and published:

  • the exact package name and version, such as @tradescript/charts-pro-acme-production-a1b2c@0.1.1
  • a one-time TRADESCRIPT_NPM_TOKEN
  • the .npmrc configuration below

The npm token only downloads that deployment's package. It is separate from the server credential used to obtain browser deployment leases.

1. Store the token​

Save TRADESCRIPT_NPM_TOKEN in your local secret manager and in the secret store used by CI. Do not commit the token, paste it into package.json, or put it directly in .npmrc.

2. Configure the registry​

Add this token-free .npmrc beside the application package.json:

.npmrc
@tradescript:registry=https://npm.tradescript.dev/
//npm.tradescript.dev/:_authToken=${TRADESCRIPT_NPM_TOKEN}

Export the token only for commands that need package access:

export TRADESCRIPT_NPM_TOKEN='the-one-time-token-you-saved'

In CI, expose the same variable to the dependency-install step from the CI secret store.

3. Confirm access​

Replace the example package coordinate with the exact value supplied for your deployment:

npm view @tradescript/charts-pro-acme-production-a1b2c@0.1.1 name version --registry=https://npm.tradescript.dev/

The command must print the exact package name and version. A 401 means the token is missing or invalid. A 404 usually means the token belongs to another deployment or the requested version has not been published.

4. Install under the stable local name​

Use an npm alias so application imports stay @tradescript/pro while npm locks the deployment-specific artifact:

npm install --save-exact '@tradescript/pro@npm:@tradescript/charts-pro-acme-production-a1b2c@0.1.1'

Commit package.json, package-lock.json, and the token-free .npmrc. Never commit the token.

The private package contains both the framework-neutral SDK and the optional React adapters. React applications import adapters from @tradescript/pro/react; no second TradeScript package or token is required.

Updates and access changes​

  • New SDK version: update the exact version in the npm alias, install, test, and commit the new lockfile.
  • New deployment: use its new package name and token. Packages and tokens are not shared between deployments.
  • Rotated token: replace TRADESCRIPT_NPM_TOKEN in local and CI secret stores. The package and lockfile do not change.
  • Revoked access: new installs fail, but files already copied into an application are not remotely deleted. Runtime deployment leases remain a separate control.

Next steps​