Set up your repository

With your agent

"Set up this repository to install through PackageMaze."

• Inspects the repository and its CI for every place packages are installed or published.
• Writes the package-client configuration that points at your Feed.
• Keeps Token secrets out of committed files — auth stays in user-level or CI configuration.
• Reviews its own changes for coverage before it calls the setup done.

Requires a connected agent. See Connect your agent.

By hand

Point each package client at your Feed Base URL and keep credentials out of Git. These are your project's files; PackageMaze validates them but does not edit them for you.

npm-compatible Feeds

Commit the nearest project .npmrc with the Feed Base URL. Add replace-registry-host=npmjs only when the Feed links the default npmjs External Feed.

registry=https://pkg.packagemaze.com/<organization>/<feed>/
replace-registry-host=npmjs

With replace-registry-host=npmjs, npm rewrites public npmjs lockfile hosts to your Feed during install. For custom upstreams, regenerate the lockfile through PackageMaze so resolved artifact URLs stay on PackageMaze.

pnpm 10.34.2+ and 11.5.3+ ignore committed ${...} credential placeholders. Keep committed pnpm .npmrc files auth-free and supply auth from user-level config, pnpm env-config, or CI temp config.

PyPI Feeds

For pip, use the Feed's PyPI Simple URL — https://pkg.packagemaze.com/<organization>/<feed>/simple/ — as the default index for installs. Do not use --extra-index-url, which keeps direct public PyPI in the resolver path. Publishes use the Feed Base URL plus /legacy/.

For uv, commit a named index in pyproject.toml and keep credentials in environment variables:

[[tool.uv.index]]
name = "packagemaze"
url = "https://pkg.packagemaze.com/<organization>/<feed>/simple/"
publish-url = "https://pkg.packagemaze.com/<organization>/<feed>/legacy/"
default = true
authenticate = "always"

Poetry is a PyPI client too: install from the Simple URL and publish to the Feed Base URL plus /legacy/.

Local credentials

Locally, the read Token lives in the MAZE_TOKEN environment variable. Prefer your operating system's secure storage — Keychain, Secret Service, or Credential Manager — over a long-lived global shell variable, and keep the Token out of Git.