[New] add publish-registry config option

[ljharb]

Summary

Adds a new publish-registry config option that allows setting a separate registry URL for npm publish and npm unpublish, while leaving registry in effect for all other operations (install, view, etc.).

This enables using a local caching proxy (VSR, Verdaccio, etc.) for reads while publishing directly to the public npm registry:

# .npmrc
registry=http://localhost:1337/npm
publish-registry=https://registry.npmjs.org/

Motivation

There is no clean way today to split read vs write registries in npm:

• publishConfig.registry in package.json is per-package, not global
• Scoped registries in .npmrc apply to both reads and writes
• --registry flag must be passed manually every time

This has been a long-standing pain point across many issues: #1937, #559, #4034, #7043, and npm/feedback#131.

Changes

• workspaces/config/lib/definitions/definitions.js: New publish-registry config definition (type: null | URL, default: null)
• lib/commands/publish.js: When publish-registry is set, overrides opts.registry before registry selection. Added to static params for help/docs.
• lib/commands/unpublish.js: Same treatment for symmetry (addresses [BUG] npm publish uses different registry then npm unpublish #559 where publish and unpublish use different registries)
• Tests: 3 new publish tests (basic usage, override by publishConfig, no effect on install registry) + 1 new unpublish test

Behavior

• null default means zero behavior change for existing users
• publishConfig.registry in package.json still takes precedence (applied later via flatten)
• Scoped registries still take precedence in pickRegistry (existing behavior)
• CLI --registry flag still takes precedence (existing behavior)

[wraithgar]

I think this may be something per-command config can help with. We need to solve the problem of setting them in .npmrc first.

[ljharb]

Absolutely per-command config would be ideal here. What's the status of that?

[wraithgar]

It shipped with the trust command. It's still in its initial iteration and needs a second dev to iterate on it probably but it's there.