* first action! (#1)

node_modules/pacote/lib/fetchers/registry/index.js

@@ -0,0 +1,32 @@
+'use strict'
+
+const cacache = require('cacache')
+const Fetcher = require('../../fetch')
+const regManifest = require('./manifest')
+const regPackument = require('./packument')
+const regTarball = require('./tarball')
+
+const fetchRegistry = module.exports = Object.create(null)
+
+Fetcher.impl(fetchRegistry, {
+  packument (spec, opts) {
+    return regPackument(spec, opts)
+  },
+
+  manifest (spec, opts) {
+    return regManifest(spec, opts)
+  },
+
+  tarball (spec, opts) {
+    return regTarball(spec, opts)
+  },
+
+  fromManifest (manifest, spec, opts) {
+    return regTarball.fromManifest(manifest, spec, opts)
+  },
+
+  clearMemoized () {
+    cacache.clearMemoized()
+    regPackument.clearMemoized()
+  }
+})

node_modules/pacote/lib/fetchers/registry/manifest.js

@@ -0,0 +1,81 @@
+'use strict'
+
+const fetch = require('npm-registry-fetch')
+const fetchPackument = require('./packument')
+const optCheck = require('../../util/opt-check')
+const pickManifest = require('npm-pick-manifest')
+const ssri = require('ssri')
+
+module.exports = manifest
+function manifest (spec, opts) {
+  opts = optCheck(opts)
+
+  return getManifest(spec, opts).then(manifest => {
+    return annotateManifest(spec, manifest, opts)
+  })
+}
+
+function getManifest (spec, opts) {
+  opts = opts.concat({
+    fullMetadata: opts.enjoyBy ? true : opts.fullMetadata
+  })
+  return fetchPackument(spec, opts).then(packument => {
+    try {
+      return pickManifest(packument, spec.fetchSpec, {
+        defaultTag: opts.defaultTag,
+        enjoyBy: opts.enjoyBy,
+        includeDeprecated: opts.includeDeprecated
+      })
+    } catch (err) {
+      if ((err.code === 'ETARGET' || err.code === 'E403') && packument._cached && !opts.offline) {
+        opts.log.silly(
+          'registry:manifest',
+          `no matching version for ${spec.name}@${spec.fetchSpec} in the cache. Forcing revalidation.`
+        )
+        opts = opts.concat({
+          preferOffline: false,
+          preferOnline: true
+        })
+        return fetchPackument(spec, opts.concat({
+          // Fetch full metadata in case ETARGET was due to corgi delay
+          fullMetadata: true
+        })).then(packument => {
+          return pickManifest(packument, spec.fetchSpec, {
+            defaultTag: opts.defaultTag,
+            enjoyBy: opts.enjoyBy
+          })
+        })
+      } else {
+        throw err
+      }
+    }
+  })
+}
+
+function annotateManifest (spec, manifest, opts) {
+  const shasum = manifest.dist && manifest.dist.shasum
+  manifest._integrity = manifest.dist && manifest.dist.integrity
+  manifest._shasum = shasum
+  if (!manifest._integrity && shasum) {
+    // Use legacy dist.shasum field if available.
+    manifest._integrity = ssri.fromHex(shasum, 'sha1').toString()
+  }
+  manifest._resolved = (
+    manifest.dist && manifest.dist.tarball
+  )
+  if (!manifest._resolved) {
+    const registry = fetch.pickRegistry(spec, opts)
+    const uri = registry.replace(/\/?$/, '/') + spec.escapedName
+
+    const err = new Error(
+      `Manifest for ${manifest.name}@${manifest.version} from ${uri} is missing a tarball url (pkg.dist.tarball). Guessing a default.`
+    )
+    err.code = 'ENOTARBALL'
+    err.manifest = manifest
+    if (!manifest._warnings) { manifest._warnings = [] }
+    manifest._warnings.push(err.message)
+    manifest._resolved =
+    `${registry}/${manifest.name}/-/${manifest.name}-${manifest.version}.tgz`
+  }
+  return manifest
+}

node_modules/pacote/lib/fetchers/registry/packument.js

@@ -0,0 +1,92 @@
+'use strict'
+
+const BB = require('bluebird')
+
+const fetch = require('npm-registry-fetch')
+const LRU = require('lru-cache')
+const optCheck = require('../../util/opt-check')
+
+// Corgis are cute. 🐕🐶
+const CORGI_DOC = 'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*'
+const JSON_DOC = 'application/json'
+
+module.exports = packument
+function packument (spec, opts) {
+  opts = optCheck(opts)
+
+  const registry = fetch.pickRegistry(spec, opts)
+  const uri = registry.replace(/\/?$/, '/') + spec.escapedName
+
+  return fetchPackument(uri, registry, spec, opts)
+}
+
+const MEMO = new LRU({
+  length: m => m._contentLength,
+  max: 200 * 1024 * 1024, // 200MB
+  maxAge: 30 * 1000 // 30s
+})
+
+module.exports.clearMemoized = clearMemoized
+function clearMemoized () {
+  MEMO.reset()
+}
+
+function fetchPackument (uri, registry, spec, opts) {
+  const mem = pickMem(opts)
+  const accept = opts.fullMetadata ? JSON_DOC : CORGI_DOC
+  const memoKey = `${uri}~(${accept})`
+  if (mem && !opts.preferOnline && mem.has(memoKey)) {
+    return BB.resolve(mem.get(memoKey))
+  }
+
+  return fetch(uri, opts.concat({
+    headers: {
+      'pacote-req-type': 'packument',
+      'pacote-pkg-id': `registry:${spec.name}`,
+      accept
+    },
+    spec
+  }, opts, {
+    // Force integrity to null: we never check integrity hashes for manifests
+    integrity: null
+  })).then(res => res.json().then(packument => {
+    packument._cached = res.headers.has('x-local-cache')
+    packument._contentLength = +res.headers.get('content-length')
+    // NOTE - we need to call pickMem again because proxy
+    //        objects get reused!
+    const mem = pickMem(opts)
+    if (mem) {
+      mem.set(memoKey, packument)
+    }
+    return packument
+  })).catch(err => {
+    if (err.code === 'E404' && !opts.fullMetadata) {
+      return fetchPackument(uri, registry, spec, opts.concat({
+        fullMetadata: true
+      }))
+    } else {
+      throw err
+    }
+  })
+}
+
+class ObjProxy {
+  get (key) { return this.obj[key] }
+  set (key, val) { this.obj[key] = val }
+}
+
+// This object is used synchronously and immediately, so
+// we can safely reuse it instead of consing up new ones
+const PROX = new ObjProxy()
+function pickMem (opts) {
+  if (!opts || !opts.memoize) {
+    return MEMO
+  } else if (opts.memoize.get && opts.memoize.set) {
+    return opts.memoize
+  } else if (typeof opts.memoize === 'object') {
+    PROX.obj = opts.memoize
+    return PROX
+  } else {
+    return null
+  }
+}

node_modules/pacote/lib/fetchers/registry/tarball.js

@@ -0,0 +1,102 @@
+'use strict'
+
+const BB = require('bluebird')
+
+const fetch = require('npm-registry-fetch')
+const manifest = require('./manifest')
+const optCheck = require('../../util/opt-check')
+const PassThrough = require('stream').PassThrough
+const ssri = require('ssri')
+const url = require('url')
+
+module.exports = tarball
+function tarball (spec, opts) {
+  opts = optCheck(opts)
+  const registry = fetch.pickRegistry(spec, opts)
+  const stream = new PassThrough()
+  let mani
+  if (
+    opts.resolved &&
+    // spec.type === 'version' &&
+    opts.resolved.indexOf(registry) === 0
+  ) {
+    // fakeChild is a shortcut to avoid looking up a manifest!
+    mani = BB.resolve({
+      name: spec.name,
+      version: spec.fetchSpec,
+      _integrity: opts.integrity,
+      _resolved: opts.resolved,
+      _fakeChild: true
+    })
+  } else {
+    // We can't trust opts.resolved if it's going to a separate host.
+    mani = manifest(spec, opts)
+  }
+
+  mani.then(mani => {
+    !mani._fakeChild && stream.emit('manifest', mani)
+    const fetchStream = fromManifest(mani, spec, opts).on(
+      'integrity', i => stream.emit('integrity', i)
+    )
+    fetchStream.on('error', err => stream.emit('error', err))
+    fetchStream.pipe(stream)
+    return null
+  }).catch(err => stream.emit('error', err))
+  return stream
+}
+
+module.exports.fromManifest = fromManifest
+function fromManifest (manifest, spec, opts) {
+  opts = optCheck(opts)
+  if (spec.scope) { opts = opts.concat({ scope: spec.scope }) }
+  const stream = new PassThrough()
+  const registry = fetch.pickRegistry(spec, opts)
+  const uri = getTarballUrl(spec, registry, manifest, opts)
+  fetch(uri, opts.concat({
+    headers: {
+      'pacote-req-type': 'tarball',
+      'pacote-pkg-id': `registry:${manifest.name}@${uri}`
+    },
+    integrity: manifest._integrity,
+    algorithms: [
+      manifest._integrity
+        ? ssri.parse(manifest._integrity).pickAlgorithm()
+        : 'sha1'
+    ],
+    spec
+  }, opts))
+    .then(res => {
+      const hash = res.headers.get('x-local-cache-hash')
+      if (hash) {
+        stream.emit('integrity', decodeURIComponent(hash))
+      }
+      res.body.on('error', err => stream.emit('error', err))
+      res.body.pipe(stream)
+      return null
+    })
+    .catch(err => stream.emit('error', err))
+  return stream
+}
+
+function getTarballUrl (spec, registry, mani, opts) {
+  const reg = url.parse(registry)
+  const tarball = url.parse(mani._resolved)
+  // https://github.com/npm/npm/pull/9471
+  //
+  // TL;DR: Some alternative registries host tarballs on http and packuments
+  // on https, and vice-versa. There's also a case where people who can't use
+  // SSL to access the npm registry, for example, might use
+  // `--registry=http://registry.npmjs.org/`. In this case, we need to
+  // rewrite `tarball` to match the protocol.
+  //
+  if (reg.hostname === tarball.hostname && reg.protocol !== tarball.protocol) {
+    tarball.protocol = reg.protocol
+    // Ports might be same host different protocol!
+    if (reg.port !== tarball.port) {
+      delete tarball.host
+      tarball.port = reg.port
+    }
+    delete tarball.href
+  }
+  return url.format(tarball)
+}