private npm repo namespace idea so that private registries don't have to replicate the entire public NPM registry or you don't have to do some sort of conditional proxying.

package.json_private_module

// A module published to a private registry would optionally have a "registry" 
// property that is a reference to the registry where this module is published. 
//
// A `npm publish` would publish to the registry in the registry property.
//
// Otherwise, `npm --registry http://private.me:5984/registry/_design/app/_rewrite publish`
// 

{
  "name": "foo",
  "description": "a module published to a private registry",
  "version": "1.0.1",
  "dependencies": {},
  "registry": "http://private.me:5984/registry/_design/app/_rewrite"
}

package.json_ref_private_reg

// If this module, `with-some-privates` depends on modules from a private registry (could be public too),
// it can register module namespaces that will be used when resolving dependencies by specifying the 
// namespace and the URL of the registry in the `registries` property.
//
// The namespaces are meaningless outside of this package.json, they are simply and alias to the registry
// for dependencies. 
//
// Dependencies would reference modules in the private registry by the namespace prefix and some delimiter,
// a hash (`#`) perhaps. 
//
// After installing the module you could require it without the namespace like
// `require('foo')  --- possible conflicts, but simplifies other things (?)
//

{
  "name": "with-some-privates",
  "description": "a module with private registry references",
  "version": "0.2.0",s
  "dependencies": {
    "request": "2.9.x",
    "myprivates#foo": "1.0.1",
    "another#bar": "0.2.0"
  },
  registries: {
    "myprivates": "http://private.me:5984/registry/_design/app/_rewrite",
    "another": "http://another.com:5984/registry/_design/app/_rewrite"
  }
}

@dominictarr The auth config is a good point. Currently when we've used a private registry at Pearson it was behind a firewall without auth to resolve modules. So how about if it finds _auth config for the alt registry it will always use it otherwise it will try without it.

So far in my hacked up npm client code I can have config that looks like this:

registry.myprivates.registry = http://registry.foo.org
registry.myprivates._auth = ....
registry.myprivates.username = ....
registry.myprivates._password = ....

If a package.json has a version dependency that's not a protocol URL but contains a hash, then it will assume the left side of the hash is the alias name of the alternate registry.

"dependencies": {
  "foo":"myprivates#1.2.3",
}

Can anyone think of any ramifications of specifying the dependency like "foo":"myprivates#1.2.3", with the alternate registry alias in the value of the dependency rather than the property name?