Make tsp install respect .npmrc configuration

[Copilot]

tsp install downloads the package manager (npm) itself before delegating to it, but that download was hardcoded to https://registry.npmjs.org and ignored any .npmrc. Users pointing at an alternative or private registry saw tsp install reach out to npmjs.org and fail.

npm config resolution

• New packages/compiler/src/package-manger/npmrc.ts resolves npm configuration in npm's precedence order: global config → user config (~/.npmrc, or npm_config_userconfig) → closest project .npmrc (walking up, skipping node_modules) → npm_config_* environment variables.
• Parsing handles comments, quoted values, ${ENV_VAR} expansion, and case-insensitive keys.
• Exposes two lookups: registry for a package (honoring @scope:registry, with TYPESPEC_NPM_REGISTRY still taking precedence) and auth headers for a URL from _authToken, _auth, or username/_password, matched from the most to the least specific path prefix.

# .npmrc
registry=https://pkgs.contoso.com/feed/npm/registry/
//pkgs.contoso.com/feed/:_authToken=${NPM_TOKEN}
@my-scope:registry=https://other.contoso.com/npm/

Install flow

• fetchPackageManifest / fetchLatestPackageManifest accept { registry, headers }, and both manifest and tarball requests now throw on non-2xx responses instead of failing later with an opaque JSON/stream error.
• installTypeSpecDependencies resolves the registry + credentials for the directory being installed, uses them for the manifest and tarball, traces the registry in use, and surfaces failures as an install-package-manager-error diagnostic rather than an internal compiler error.

Credential scoping

Auth headers are always resolved from the URL being requested, so credentials are only sent to hosts they are configured for. Registry credentials are not reused for a tarball hosted on a different origin.

Tests

test/package-manager/npmrc.test.ts covers parsing, file precedence, scoped registries, env var expansion/overrides, node_modules exclusion, and credential matching (parent-path prefixes, non-matching hosts, basic auth variants). npm-registry.test.ts gains coverage for the new options and error behavior.

• Fixes tsp install ignores user .npmrc #11665

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@typespec/compiler@11666

commit: 82da720