The registry was set globally (
egistry=...), which forced all public
transitive deps through the private Verdaccio. Verdaccio has no uplink,
so
pm install 404'd on public packages. Scope the registry to
@aetoskia:registry=... so public deps resolve from npmjs and only
@aetoskia/* go to the private registry.
Drone runs each command list item in a separate shell, so a
standalone NPM_HOST= line is empty when the next item references it,
writing //:_auth= (wrong host) and causing a registry 401. Compute
NPM_HOST in the same | block that writes .npmrc.
npm rejects a bare _auth key (ERR_INVALID_AUTH) against a private
registry; derive the host from NPM_REPO_URL and write
//<host>/:_auth=<base64> instead.
