private npm repo namespace idea so that private registries don't have to replicate the entire public NPM registry or you don't have to do some sort of conditional proxying.

package.json_private_module

// A module published to a private registry would optionally have a "registry" 
// property that is a reference to the registry where this module is published. 
//
// A `npm publish` would publish to the registry in the registry property.
//
// Otherwise, `npm --registry http://private.me:5984/registry/_design/app/_rewrite publish`
// 

{
  "name": "foo",
  "description": "a module published to a private registry",
  "version": "1.0.1",
  "dependencies": {},
  "registry": "http://private.me:5984/registry/_design/app/_rewrite"
}

package.json_ref_private_reg

// If this module, `with-some-privates` depends on modules from a private registry (could be public too),
// it can register module namespaces that will be used when resolving dependencies by specifying the 
// namespace and the URL of the registry in the `registries` property.
//
// The namespaces are meaningless outside of this package.json, they are simply and alias to the registry
// for dependencies. 
//
// Dependencies would reference modules in the private registry by the namespace prefix and some delimiter,
// a hash (`#`) perhaps. 
//
// After installing the module you could require it without the namespace like
// `require('foo')  --- possible conflicts, but simplifies other things (?)
//

{
  "name": "with-some-privates",
  "description": "a module with private registry references",
  "version": "0.2.0",s
  "dependencies": {
    "request": "2.9.x",
    "myprivates#foo": "1.0.1",
    "another#bar": "0.2.0"
  },
  registries: {
    "myprivates": "http://private.me:5984/registry/_design/app/_rewrite",
    "another": "http://another.com:5984/registry/_design/app/_rewrite"
  }
}

and if you are gonna configure the auth in the config, maybe you should configure the url there too.

[registry.joyent]
url= ...
auth= ...

and then when "trade-secrets@joyent": "1.0" appears in the package.json npm will know that it's at the url you've specified. otherwise, if you want to move the registry or something, you'll have to go and update ALL your modules.

@dominictarr The auth config is a good point. Currently when we've used a private registry at Pearson it was behind a firewall without auth to resolve modules. So how about if it finds _auth config for the alt registry it will always use it otherwise it will try without it.

So far in my hacked up npm client code I can have config that looks like this:

registry.myprivates.registry = http://registry.foo.org
registry.myprivates._auth = ....
registry.myprivates.username = ....
registry.myprivates._password = ....

If a package.json has a version dependency that's not a protocol URL but contains a hash, then it will assume the left side of the hash is the alias name of the alternate registry.

"dependencies": {
  "foo":"myprivates#1.2.3",
}

Can anyone think of any ramifications of specifying the dependency like "foo":"myprivates#1.2.3", with the alternate registry alias in the value of the dependency rather than the property name?