@jsdevtools/npm-publish 3.1.0 → 4.0.0

package/src/normalize-options.ts

@@ -1,17 +1,17 @@
 import os from "node:os";
 
 import * as errors from "./errors.js";
-import type { PackageManifest } from "./read-manifest.js";
 import {
+  type Access,
   ACCESS_PUBLIC,
   ACCESS_RESTRICTED,
-  STRATEGY_UPGRADE,
-  STRATEGY_ALL,
-  type Access,
-  type Strategy,
-  type Options,
   type Logger,
+  type Options,
+  type Strategy,
+  STRATEGY_ALL,
+  STRATEGY_UPGRADE,
 } from "./options.js";
+import type { PackageManifest } from "./read-manifest.js";
 
 const REGISTRY_NPM = "https://registry.npmjs.org/";
 export const TAG_LATEST = "latest";
@@ -97,8 +97,13 @@ const validateRegistry = (value: unknown): URL => {
 };
 
 const validateTag = (value: unknown): string => {
-  if (typeof value === "string" && value.length > 0) {
-    return value;
+  if (typeof value === "string") {
+    const trimmedValue = value.trim();
+    const encodedValue = encodeURIComponent(trimmedValue);
+
+    if (trimmedValue.length > 0 && trimmedValue === encodedValue) {
+      return value;
+    }
   }
 
   throw new errors.InvalidTagError(value);

package/src/npm/call-npm-cli.ts

@@ -36,9 +36,11 @@ export const VIEW = "view";
 export const PUBLISH = "publish";
 
 export const E404 = "E404";
+export const E409 = "E409";
 export const EPUBLISHCONFLICT = "EPUBLISHCONFLICT";
 
-const NPM = os.platform() === "win32" ? "npm.cmd" : "npm";
+const IS_WINDOWS = os.platform() === "win32";
+const NPM = IS_WINDOWS ? "npm.cmd" : "npm";
 const JSON_MATCH_RE = /(\{[\s\S]*\})/mu;
 
 const baseArguments = (options: NpmCliOptions) =>
@@ -68,15 +70,14 @@ export async function callNpmCli<CommandT extends string>(
   let error;
 
   if (exitCode === 0) {
-    successData = parseJson<SuccessData<CommandT>>(stdout);
+    successData = parseJson(stdout) as SuccessData<CommandT> | undefined;
   } else {
-    const errorPayload = parseJson<{ error?: { code?: unknown } }>(
-      stdout,
-      stderr
-    );
+    const errorPayload = parseJson(stdout, stderr) as
+      | { error?: { code?: unknown } }
+      | undefined;
 
-    if (errorPayload?.error?.code) {
-      errorCode = String(errorPayload.error.code).toUpperCase();
+    if (typeof errorPayload?.error?.code === "string") {
+      errorCode = errorPayload.error.code.toUpperCase();
     }
 
     error = new errors.NpmCallError(command, exitCode, stderr);
@@ -106,10 +107,11 @@ async function execNpm(
 
     const npm = childProcess.spawn(NPM, commandArguments, {
       env: { ...process.env, ...environment },
+      shell: IS_WINDOWS,
     });
 
-    npm.stdout.on("data", (data) => (stdout += data));
-    npm.stderr.on("data", (data) => (stderr += data));
+    npm.stdout.on("data", (data: string) => (stdout += data));
+    npm.stderr.on("data", (data: string) => (stderr += data));
     npm.on("close", (code) => {
       logger?.debug?.(`Received stdout: ${stdout}`);
       logger?.debug?.(`Received stderr: ${stderr}`);
@@ -132,13 +134,13 @@ async function execNpm(
  * @param values CLI outputs to check
  * @returns Parsed JSON, if able to parse.
  */
-function parseJson<TParsed>(...values: string[]): TParsed | undefined {
+function parseJson(...values: string[]): unknown {
   for (const value of values) {
     const jsonValue = JSON_MATCH_RE.exec(value)?.[1];
 
     if (jsonValue) {
       try {
-        return JSON.parse(jsonValue) as TParsed;
+        return JSON.parse(jsonValue);
       } catch {
         return undefined;
       }

package/src/npm/use-npm-environment.ts

@@ -2,8 +2,8 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 
-import type { PackageManifest } from "../read-manifest.js";
 import type { NormalizedOptions } from "../normalize-options.js";
+import type { PackageManifest } from "../read-manifest.js";
 
 export type NpmCliEnvironment = Record<string, string>;
 
@@ -29,22 +29,21 @@ export async function useNpmEnvironment<TReturn>(
   task: NpmCliTask<TReturn>
 ): Promise<TReturn> {
   const { registry, token, logger, temporaryDirectory } = options;
-  const npmrcDirectory = await fs.mkdtemp(
-    path.join(temporaryDirectory, "npm-publish-")
-  );
-  const npmrc = path.join(npmrcDirectory, ".npmrc");
-  const environment = {
-    NODE_AUTH_TOKEN: token,
-    npm_config_userconfig: npmrc,
-  };
-
+  const { host, origin, pathname } = registry;
+  const pathnameWithSlash = pathname.endsWith("/") ? pathname : `${pathname}/`;
   const config = [
     "; created by jsdevtools/npm-publish",
-    `//${registry.host}/:_authToken=\${NODE_AUTH_TOKEN}`,
-    `registry=${registry.href}`,
+    `//${host}${pathnameWithSlash}:_authToken=\${NODE_AUTH_TOKEN}`,
+    `registry=${origin}${pathnameWithSlash}`,
     "",
   ].join(os.EOL);
 
+  const npmrcDirectory = await fs.mkdtemp(
+    path.join(temporaryDirectory, "npm-publish-")
+  );
+  const npmrc = path.join(npmrcDirectory, ".npmrc");
+  const environment = { NODE_AUTH_TOKEN: token, npm_config_userconfig: npmrc };
+
   await fs.writeFile(npmrc, config, "utf8");
 
   logger?.debug?.(`Temporary .npmrc created at ${npmrc}\n${config}`);

package/src/npm-publish.ts

@@ -1,9 +1,9 @@
-import { readManifest } from "./read-manifest.js";
-import { normalizeOptions } from "./normalize-options.js";
-import { useNpmEnvironment } from "./npm/index.js";
 import { compareAndPublish } from "./compare-and-publish/index.js";
 import { formatPublishResult } from "./format-publish-result.js";
+import { normalizeOptions } from "./normalize-options.js";
+import { useNpmEnvironment } from "./npm/index.js";
 import type { Options } from "./options.js";
+import { readManifest } from "./read-manifest.js";
 import type { Results } from "./results.js";
 
 /**

package/src/read-manifest.ts

@@ -1,8 +1,11 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+
 import semverValid from "semver/functions/valid.js";
-import tarList from "tar/lib/list.js";
 import type { ReadEntry } from "tar";
+import { list as tarList } from "tar/list";
+import validatePackageName from "validate-npm-package-name";
+
 import * as errors from "./errors.js";
 
 /** A package manifest (package.json) and associated details. */
@@ -39,10 +42,14 @@ const isTarball = (file: unknown): file is string => {
   return typeof file === "string" && path.extname(file) === TARBALL_EXTNAME;
 };
 
-const validateVersion = (version: unknown): string | undefined => {
+const normalizeVersion = (version: unknown): string | undefined => {
   return semverValid(version as string) ?? undefined;
 };
 
+const validateName = (name: unknown): name is string => {
+  return validatePackageName(name as string).validForNewPackages;
+};
+
 const readPackageJson = async (...pathSegments: string[]): Promise<string> => {
   const file = path.resolve(...pathSegments);
 
@@ -55,14 +62,14 @@ const readPackageJson = async (...pathSegments: string[]): Promise<string> => {
 
 const readTarballPackageJson = async (file: string): Promise<string> => {
   const data: Buffer[] = [];
-  const onentry = (entry: ReadEntry) => {
+  const onReadEntry = (entry: ReadEntry) => {
     if (entry.path === "package/package.json") {
       entry.on("data", (chunk) => data.push(chunk));
     }
   };
 
   try {
-    await tarList({ file, onentry });
+    await tarList({ file, onReadEntry });
 
     if (data.length === 0) {
       throw new Error("package.json not found inside archive");
@@ -109,19 +116,19 @@ export async function readManifest(
 
   try {
     manifestJson = JSON.parse(manifestContents) as Record<string, unknown>;
-    name = manifestJson["name"];
-    version = validateVersion(manifestJson["version"]);
-    publishConfig = manifestJson["publishConfig"] ?? {};
+    name = manifestJson.name;
+    version = normalizeVersion(manifestJson.version);
+    publishConfig = manifestJson.publishConfig ?? {};
   } catch (error) {
     throw new errors.PackageJsonParseError(packageSpec, error);
   }
 
-  if (typeof name !== "string" || name.length === 0) {
+  if (!validateName(name)) {
     throw new errors.InvalidPackageNameError(name);
   }
 
   if (typeof version !== "string") {
-    throw new errors.InvalidPackageVersionError(manifestJson["version"]);
+    throw new errors.InvalidPackageVersionError(manifestJson.version);
   }
 
   if (

package/src/results.ts

@@ -1,6 +1,7 @@
-import type { Access, Strategy } from "./options.js";
 import type { ReleaseType as SemverReleaseType } from "semver";
 
+import type { Access, Strategy } from "./options.js";
+
 /** Release type */
 export type ReleaseType = SemverReleaseType | typeof INITIAL | typeof DIFFERENT;
 

package/src/tar.d.ts

@@ -1,3 +0,0 @@
-declare module "tar/lib/list.js" {
-  export { list as default } from "tar";
-}