Support private npm packages on esm.sh

[tjconcept]

My last blocker, it seems, to getting rid of npm (and bundling) for modern frontend development is the fact that private packages on npm aren't accessible with the same immutable, versioned URL as public ones.

What I could wish for is not really "private" packages, as those obviously can't go through a public CDN, but rather "secret" or "hidden" ones. I'm imagining a query parameter for an npm token to the regular esm.sh package URL, which will then fetch the private package using the token, create a secret URL (e.g. the regular package URL with a random token appended), and redirect to this URL.

Do better alternatives exist? Is it a bad idea for some reason?

[ije]

i think it's not safe to expose the token to esm.sh server, instead you should deploy the server by your own with the --npm-token flag.

[tjconcept]

How would that be any different from handing over a token to a CI tool?

It can be read-only and deleted afterwards.