[Question] Response timeouts for packages

I saw as of npm-registry-fetch@4.0.3 that the default timeout for requests is 30s (https://github.com/npm/cli/commit/ea0ff56cb6ad4bbf208dd3cf39a35e07fc2dff16)

I think that should be fine.

I'm curious about the endpoints that are being requested using npm ci for example.

My understanding is that the package-lock.json file should already have a "resolved" tarfile, and should just download that:

    "typescript": {
      "version": "4.2.4",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.2.4.tgz",
      "integrity": "sha512-V+evlYHZnQkaz8TRBuxTA92yZBPotr5H+WhQ7bD3hZUndx5tGOa1fuCgeSjxAzM1RiN5IzvadIXTVefuuwZCRg==",
      "dev": true
    }

But (given my network situation) this request can timeout; not because it's requesting the .tgz file, but because it's requesting https://registry.npmjs.org/typescript (which appears to be just a JSON list of versions?)

Why is this happening, if there is a resolved tarfile, and how could I prevent this/improve the performance of my installs?

Start by reproducing the npm ci request behavior described for package-lock.json and the TypeScript tarball, then trace how npm-registry-fetch@4.0.3 is used. Compare requests to registry.npmjs.org/typescript with requests to the resolved .tgz URL; done means documenting why both occur and which supported install or timeout options address it.