PackagePass docs
Everything you need to publish and distribute private TypeScript packages.
PackagePass has two surfaces: an npm-compatible registry for installs and a control plane for package metadata, access grants, install tokens, audit events, previews, and release automation.
Control API
https://api.preview.packagepass.dev/v1
Registry URL
https://registry.preview.packagepass.dev/npm/
Start here
Choose the path that matches your job.
The CLI is best for local publishing and setup. The TypeScript SDK is best when package distribution is part of your product or release automation. The API reference documents the underlying control plane.
Getting Started
Create a package, publish a release, grant access, and install from the private registry.
CLI
Daily workflows for publishing, grants, install tokens, previews, audit, and troubleshooting.
TypeScript SDK
Use PackagePass from product onboarding, CI, internal tools, and release automation.
Permissions
Understand tokens, subjects, grants, actions, resource inheritance, and policy debugging.
API Reference
Control-plane endpoints, authentication, response envelopes, errors, and registry endpoints.
Guides
Focused recipes for releases, preview packages, customer installs, and policy debugging.
The core workflow
- 1
Create a tenant, scope, and package
A tenant owns the registry namespace. A scope maps packages such as @acme/payments to PackagePass's registry URL. - 2
Publish a tarball
The CLI validates package.json, runs npm pack, uploads the artifact, and moves the chosen dist-tag. - 3
Grant access
A subject receives explicit actions such as package:install or package:publish on a tenant, package, or package version. - 4
Mint a token and configure installs
Generate .npmrc or bunfig.toml config for the package manager and use a scoped install token at install time.
Key concepts
These terms show up in the CLI, SDK, API, policy decisions, registry requests, and audit events.
| Term | Meaning |
|---|---|
| Tenant | The account boundary for packages, subjects, tokens, grants, and audit events. |
| Scope | An npm scope such as @acme. Install config maps the scope to PackagePass's registry URL. |
| Package | A private scoped npm package record, for example @acme/payments. Install access is controlled by PackagePass grants. |
| Version | A published package artifact. Versions can be active, deprecated, or yanked. |
| Preview | A temporary package version published to a channel-backed dist-tag such as preview-pr-482. |
| Subject | The actor that receives access: user, group, agent, or customer. Agents cover AI workers, services, and CI jobs. |
| Grant | A policy record that allows actions on a tenant, scope, package, or package version. |
| Token | A scoped credential minted for API automation, package installs, or CI exchange. |
What PackagePass validates before publishing
Scoped package names
@acme/payments.