@maka/meteor-sdk 0.2.2 → 0.2.4

package/README.md

@@ -42,6 +42,15 @@ the target app's own `.meteor/release` (e.g. `"METEOR@3.5.1"`) -- it pins
 which Meteor release's package versions and build behavior this process
 uses.
 
+Passing a specific release requires that release to be present in the
+local package catalog (the Meteor warehouse) -- on a machine that has
+never downloaded it, `init` rejects with a `MeteorSdkError` naming the
+missing release. **Embedders that only need `connectDdp()` (or other
+non-build APIs) should call `init({})` with no release**: that uses
+checkout semantics (the tool copy this package itself ships), needs no
+warehouse or catalog access, and works on a machine whose only Meteor
+footprint is this npm package.
+
 ### `loadProject(appDir)`
 
 Resolves an app directory into a `Project`, ready to bundle or run.

package/isopackets/combined/npm/node_modules/meteor/babel-compiler/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-10g0ajfucol",
+  "name": "package-new-1snkx7vjcuf",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/boilerplate-generator/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1slwkyce3sz",
+  "name": "package-new-4u9fx8mbxny",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/constraint-solver/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-fmtb13edl7",
+  "name": "package-new-sm91z7t3z4o",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ddp-client/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-17ww1zgjylj",
+  "name": "package-new-gsvm5rcc2iq",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-g6t4wfio7ve",
+  "name": "package-new-3gg4doz5i88",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript-runtime/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-aqph2241bof",
+  "name": "package-new-1nb1rwir7xu",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript-runtime-client/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-xcpgqd2fln9",
+  "name": "package-new-1jo8olhxkjm",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript-runtime-server/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1cqofk7h0vn",
+  "name": "package-new-2ybexym7dno",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/fetch/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1g6gs3yfiwp",
+  "name": "package-new-i9b1vaovh2j",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/inter-process-messaging/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-nt8samf9uwk",
+  "name": "package-new-dymdsziwayf",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/logging/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-ksjvqwow5eq",
+  "name": "package-new-ffz4udz1rzl",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/logic-solver/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-usn32d5f7m",
+  "name": "package-new-1gj1i1e8erq",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/meteor/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1wbkujoz6iei",
+  "name": "package-new-1hynmr3gjvhf",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/modules/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-s9fhxhunuf",
+  "name": "package-new-1ffagznc9qh",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/modules-runtime/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1v67hnpaktth",
+  "name": "package-new-e37v0zigxr6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/npm-mongo/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-3xnmqbs5th5",
+  "name": "package-new-wfebwy06fwm",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/package-version-parser/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-xjm9993m8hk",
+  "name": "package-new-dbv0mrj9kh",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/promise/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-d5x03oy37qo",
+  "name": "package-new-4rd6cn8q4z7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/react-fast-refresh/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-15icl6ez9mo",
+  "name": "package-new-m44yzrtc8cq",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/socket-stream-client/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1wtb47fkaa7",
+  "name": "package-new-c4g2z219k47",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maka/meteor-sdk",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Programmatic Node API over the Meteor build tool (bundle/run/create/etc.) -- for driving Meteor's build system from plain Node code instead of shelling out to a meteor CLI (there isn't one anymore; see README.md). \"dependencies\" is generated by scripts/write-tool-package-json.js from scripts/dev-bundle-tool-package.js at the monorepo root -- do not hand-edit that field, edit that file and re-run the script instead.",
   "main": "src/index.js",
   "exports": {
@@ -44,10 +44,8 @@
     "source-map-v01": "npm:source-map@0.1.32",
     "@types/semver": "7.5.8",
     "semver": "7.6.3",
-    "request": "2.88.2",
-    "uuid": "8.3.2",
+    "undici": "8.10.0",
     "graceful-fs": "4.2.11",
-    "tar": "6.1.11",
     "tar-fs": "2.1.1",
     "source-map": "0.7.4",
     "chalk": "4.1.2",
@@ -56,8 +54,7 @@
     "is-reachable": "3.1.0",
     "wordwrap": "1.0.0",
     "moment": "2.30.1",
-    "rimraf": "2.6.2",
-    "glob": "11.0.1",
+    "glob": "13.0.6",
     "ignore": "7.0.5",
     "commonmark": "0.15.0",
     "escope": "4.0.0",

package/src/release.js

@@ -36,7 +36,43 @@ async function init(options) {
   // release cached (or be reachable); see release.load's own doc comment
   // in meteor-tool for the exact fetch/cache behavior.
   const releaseName = options.release == null ? null : options.release;
-  const releaseObject = await release.load(releaseName);
+  let releaseObject;
+  try {
+    releaseObject = await release.load(releaseName);
+  } catch (e) {
+    // release.NoSuchReleaseError is an EMPTY constructor -- not even an
+    // Error, no .message -- so embedders logging err.message printed
+    // "undefined" and the real cause (release not in the local package
+    // catalog, e.g. a machine with no populated Meteor warehouse) was
+    // invisible. Cost a real debugging evening in the field; wrap it
+    // (and any other message-less throw from release.load) in a proper
+    // MeteorSdkError that names the release and where the catalog lives.
+    let warehouse = "~/.meteor";
+    try {
+      warehouse = require("../tools/packaging/tropohouse.js").default.root;
+    } catch (_) {
+      // Best effort -- the default hint above is close enough.
+    }
+    if (e instanceof release.NoSuchReleaseError) {
+      throw new MeteorSdkError(
+        "init(): release " + JSON.stringify(releaseName) + " is not in " +
+          "the local package catalog (warehouse: " + warehouse + "). " +
+          "On a machine that has never downloaded that Meteor release " +
+          "this is expected -- either install/download the release " +
+          "first, or, for embedders that only need connectDdp() and " +
+          "other non-build APIs, call init({}) with no release (checkout " +
+          "semantics, no catalog needed)."
+      );
+    }
+    if (e instanceof Error) {
+      throw e;
+    }
+    throw new MeteorSdkError(
+      "init(): release.load(" + JSON.stringify(releaseName) + ") failed " +
+        "with a message-less throw (" + Object.prototype.toString.call(e) +
+        "); warehouse: " + warehouse
+    );
+  }
   // forced is always true: init({release}) is the embedder explicitly
   // choosing the release for this process -- the moral equivalent of the
   // CLI's --release flag, which is exactly what release.forced means.

package/tools/fs/dev-bundle-links.js

@@ -22,7 +22,7 @@ exports.makeLink = function (target, linkPath) {
     fs.renameSync(tempPath, linkPath);
   } catch (e) {
     // If renaming fails, try unlinking first.
-    require("rimraf").sync(linkPath);
+    require("fs").rmSync(linkPath, { recursive: true, force: true });
     fs.renameSync(tempPath, linkPath);
   }
 };

package/tools/fs/files.ts

@@ -30,7 +30,6 @@ import { realpathSync } from './fsFixPath';
 
 const _ = require('underscore');
 
-const rimraf = require('rimraf');
 const sourcemap = require('source-map');
 const sourceMapRetrieverStack = require('../tool-env/source-map-retriever-stack.js');
 
@@ -322,7 +321,16 @@ export function getCurrentNodeBinDir() {
 // Return the top-level directory for this meteor install or checkout
 export function getCurrentToolsDir() {
   if (!process.env.SANDBOX && process.env.METEOR_WAREHOUSE_DIR) {
-    return pathDirname(realpathSync(pathJoin(process.env.METEOR_WAREHOUSE_DIR, 'meteor')));
+    // Only follow the warehouse's `meteor` link when it actually exists:
+    // an empty/fresh METEOR_WAREHOUSE_DIR (observed: SDK embedders
+    // pointing the env var at a scratch dir) made realpathSync throw
+    // ENOENT uncaught through getToolBundleRoot() and everything above
+    // it. Falling through to the __dirname-based answer keeps the
+    // running tool copy resolvable regardless of warehouse state.
+    const warehouseMeteor = pathJoin(process.env.METEOR_WAREHOUSE_DIR, 'meteor');
+    if (exists(warehouseMeteor)) {
+      return pathDirname(realpathSync(warehouseMeteor));
+    }
   }
 
   return pathDirname(pathDirname(convertToStandardPath(__dirname)));
@@ -457,16 +465,21 @@ export function realpathOrNull(path: string) {
 
 export function rm_recursive_async(path: string) {
   return new Promise<void>((resolve, reject) => {
-    rimraf(convertToOSPath(path), (err: Error) => err
-      ? reject(err)
-      : resolve());
+    // fs.rm with force+maxRetries replaces the old rimraf dependency
+    // (Node's built-in grew the same EPERM/EBUSY retry behavior it
+    // existed for).
+    fs.rm(
+      convertToOSPath(path),
+      { recursive: true, force: true, maxRetries: 3 },
+      (err) => err ? reject(err) : resolve()
+    );
   });
 }
 
 // Like rm -r.
 export const rm_recursive = Profile("files.rm_recursive", async (path: string) => {
   try {
-    rimraf.sync(convertToOSPath(path));
+    fs.rmSync(convertToOSPath(path), { recursive: true, force: true });
   } catch (e: any) {
     if ((e.code === "ENOTEMPTY" ||
          e.code === "EPERM")) {
@@ -1734,7 +1747,7 @@ export const rename = isWindowsLikeFilesystem() ? function (from: string, to: st
         // Despite previous failures, the top-level destination directory
         // may have been successfully created, so we must remove it to
         // avoid moving the source file *into* the destination directory.
-        rimraf.sync(osTo);
+        fs.rmSync(osTo, { recursive: true, force: true });
         wrappedRename(from, to);
         resolve();
       } catch (err: any) {

package/tools/utils/http-helpers.js

@@ -1,6 +1,15 @@
 ///
 /// utility functions for dealing with urls and http
 ///
+/// Implemented on undici's fetch (the engine behind Node's own global
+/// fetch) rather than the long-deprecated `request` package -- request
+/// dragged har-validator and uuid@3 (both deprecation-flagged on every
+/// consumer install) and has been unmaintained since 2020. The public
+/// surface here (request/getUrl/getUrlWithResuming and their option
+/// shapes) is preserved for the nine in-tree callers; see the audit in
+/// the git history of this rewrite for exactly which options each
+/// caller uses.
+///
 
 var os = require('os');
 var util = require('util');
@@ -38,6 +47,13 @@ class ConcatStream extends Writable {
     return this.chunks[0];
   }
 
+  // A resumed download whose server ignored our Range header restarts
+  // from byte 0 -- drop what we had so we don't concatenate duplicates.
+  reset() {
+    this.chunks = [];
+    this.size = 0;
+  }
+
   end(force = false) {
     // Override the Writable#end method to ignore any .end() calls for
     // this stream, since we likely want to resume the download later.
@@ -47,51 +63,6 @@ class ConcatStream extends Writable {
   }
 }
 
-// Helper that tracks bytes written to a writable
-var WritableWithProgress = function (writable, listener) {
-  var self = this;
-  self._inner = writable;
-  self._listener = listener;
-};
-
-Object.assign(WritableWithProgress.prototype, {
-  write: function (chunk, encoding, callback) {
-    var self = this;
-    self._listener(chunk.length, false);
-    return self._inner.write(chunk, encoding);
-  },
-
-  end: function (chunk, encoding, callback) {
-    var self = this;
-    self._listener(chunk ? chunk.length : 0, true);
-    return self._inner.end(chunk, encoding);
-  },
-
-  _progress: function (n, done) {
-    var self = this;
-
-    var state = self._state;
-    state.current += n;
-    if (done) {
-      state.current.done = true;
-    }
-    self.progress.reportProgress(state);
-  },
-
-  on: function (name, callback) {
-    return this._inner.on(name, callback);
-  },
-
-  once: function () {
-    return this._inner.once(...arguments);
-  },
-
-  emit: function () {
-    return this._inner.emit(...arguments);
-  }
-});
-
-
 // Compose a User-Agent header.
 var getUserAgent = function () {
   var version;
@@ -111,45 +82,70 @@ var getUserAgent = function () {
                      os.platform(), os.type(), os.release(), os.arch());
 };
 
+// Builds the undici dispatcher for this request: env-var proxy support
+// (same env semantics the request package had, and the same explicit
+// detection packages/socket-stream-client uses) and CAFILE support.
+function buildDispatcher(url, undici) {
+  var proxy = process.env.HTTP_PROXY || process.env.http_proxy || null;
+  if (/^https/i.test(url)) {
+    proxy = process.env.HTTPS_PROXY || process.env.https_proxy || proxy;
+  }
+
+  var connect;
+  if (process.env.CAFILE) {
+    connect = { ca: files.readFile(process.env.CAFILE) };
+  }
+
+  if (proxy) {
+    return new undici.ProxyAgent(
+      connect ? { uri: proxy, connect } : { uri: proxy }
+    );
+  }
+  if (connect) {
+    return new undici.Agent({ connect });
+  }
+  return undefined;
+}
+
+// Wraps a Node Readable request body in an async generator that reports
+// upload progress per chunk.
+async function* streamWithProgress(bodyStream, onChunk) {
+  for await (const chunk of bodyStream) {
+    onChunk(chunk.length);
+    yield chunk;
+  }
+}
 
 var httpHelpers = exports;
 Object.assign(exports, {
   getUserAgent: getUserAgent,
 
-  // A wrapper around request with the following improvements:
+  // A fetch-based replacement for the old request-package wrapper, with
+  // the same contract:
   //
-  // - It will respect proxy environment variables if present
-  //   (HTTP_PROXY or HTTPS_PROXY as appropriate).
+  // - Respects HTTP_PROXY/HTTPS_PROXY, sets a Meteor User-Agent, honors
+  //   $CAFILE for a custom CA.
   //
-  // - It will set a reasonable User-Agent header.
+  // - Never follows redirects (fetch redirect: "manual"): redirects
+  //   don't segregate cookies/headers by origin, and callers like the
+  //   OAuth flow in auth.js depend on seeing the 302 themselves.
   //
-  // - If you omit the callback it will run synchronously. The return
-  //   value will be an object with keys 'response' and 'body' (with
-  //   the same meaning as the arguments to request's normal
-  //   callback), or it will throw.
+  // - Options: url (or a bare url string instead of the object), method,
+  //   headers, qs (object appended to the url as a query string),
+  //   json: true (parse the response body as JSON), encoding
+  //   (null => body is a Buffer; anything else => utf8 string, the
+  //   default), bodyStream (+ bodyStreamLength) for a streamed request
+  //   body, outputStream to stream the response body into (body is not
+  //   buffered then), progress (a progress tracker; incompatible with
+  //   callback), timeout (idle ms between response chunks; default 60s,
+  //   disable by passing a non-positive/non-number), useSessionHeader /
+  //   useAuthHeader for the Meteor services session file.
   //
-  // - If Set-Cookie headers are present on the response, *and* you
-  //   are using a callback, it will parse the cookies and include
-  //   them as a setCookie attribute on the object passed to the
-  //   callback. setCookie is a simple map from cookie name to cookie
-  //   value. If you want expiration time and attributes you'll have
-  //   to parse it yourself. If there are multiple Set-Cookie headers
-  //   for the same cookie it is unspecified which one you'll get.
-  //
-  // - You can provide a 'bodyStream' option which is a stream that
-  //   will be used for the body of the request.
-  //
-  // - For authenticated Meteor Software services, you can set the
-  //   'useSessionHeader' and/or 'useAuthHeader' options (to true) to
-  //   send X-Meteor-Session/X-Meteor-Auth headers using values from
-  //   the session file.
-  //
-  // - forceSSL is always set to true. Always. And followRedirect is
-  //   set to false since it doesn't understand origins (see comment
-  //   in implementation).
-  //
-  // - An optional options.onRequest callback may be provided if the
-  //   caller desires access to the request object.
+  // - Without a callback, returns a Promise of { response, body,
+  //   setCookie }. response is a plain object: { statusCode, headers
+  //   (lowercased plain object), request: { href } } -- the subset of
+  //   the old request response our callers read. With a callback, calls
+  //   callback(err, response, body) instead.
   //
   // NB: With useSessionHeader and useAuthHeader, this function will
   // read *and possibly write to* the session file, so if you are
@@ -163,75 +159,41 @@ Object.assign(exports, {
       options = _.clone(urlOrOptions);
     }
 
-    var outputStream;
-    if (_.has(options, 'outputStream')) {
-      outputStream = options.outputStream;
-      delete options.outputStream;
-    }
-
-    var bodyStream;
-    if (_.has(options, 'bodyStream')) {
-      bodyStream = options.bodyStream;
-      delete options.bodyStream;
-    }
+    var outputStream = options.outputStream;
+    var bodyStream = options.bodyStream;
 
     // Body stream length for progress
     var bodyStreamLength = 0;
     if (_.has(options, 'bodyStreamLength')) {
       bodyStreamLength = options.bodyStreamLength;
-      delete options.bodyStreamLength;
-    } else {
+    } else if (bodyStream) {
       // Guess the body stream length as 1MB
       // Hopefully if it's much bigger the caller will set it
       // If it is much small, we will pleasantly surprise the user!
-      if (bodyStream) {
-        bodyStreamLength = 1024 * 1024;
-      }
+      bodyStreamLength = 1024 * 1024;
     }
 
     // Response length for progress
     var responseLength = 128 * 1024;
     if (_.has(options, 'responseLength')) {
       responseLength = options.responseLength;
-      delete options.responseLength;
     }
 
-    var progress = null;
-    if (_.has(options, 'progress')) {
-      progress = options.progress;
-      delete options.progress;
-
-      if (callback) {
-        throw new Error("Not safe to use progress with callback");
-      }
+    var progress = options.progress || null;
+    if (progress && callback) {
+      throw new Error("Not safe to use progress with callback");
     }
 
-    options.headers = Object.assign({
+    var headers = Object.assign({
       'User-Agent': getUserAgent()
     }, options.headers || {});
 
-    // This should never, ever be false, or else why are you using SSL?
-    options.forceSSL = true;
-    if (process.env.CAFILE) {
-      options.ca = files.readFile(process.env.CAFILE);
-    }
-
-    // followRedirect is very dangerous because request does not
-    // appear to segregate cookies by origin, so any cookies (and
-    // apparently headers as well, eg X-Meteor-Auth) sent on the
-    // original request could get forwarded to an unexpected domain in
-    // a redirect. This is almost certainly not something you ever
-    // want.
-    options.followRedirect = false;
-
     var useSessionHeader = options.useSessionHeader;
-    delete options.useSessionHeader;
     var useAuthHeader = options.useAuthHeader;
-    delete options.useAuthHeader;
     if (useSessionHeader || useAuthHeader) {
       var sessionHeader = auth.getSessionId(config.getAccountsDomain());
       if (sessionHeader) {
-        options.headers['X-Meteor-Session'] = sessionHeader;
+        headers['X-Meteor-Session'] = sessionHeader;
       }
       if (callback) {
         throw new Error("session header can't be used with callback");
@@ -240,170 +202,197 @@ Object.assign(exports, {
     if (useAuthHeader) {
       var authHeader = auth.getSessionToken(config.getAccountsDomain());
       if (authHeader) {
-        options.headers['X-Meteor-Auth'] = authHeader;
+        headers['X-Meteor-Auth'] = authHeader;
       }
     }
 
-    var promise;
-    if (! callback) {
-      promise = new Promise(function (resolve, reject) {
-        callback = function (err, response, body) {
-          if (err) {
-            reject(err);
-            return;
-          }
-
-          var setCookie = {};
-          _.each(response.headers["set-cookie"] || [], function (h) {
-            var match = h.match(/^([^=\s]+)=([^;\s]+)/);
-            if (match) {
-              setCookie[match[1]] = match[2];
-            }
-          });
-
-          if (useSessionHeader && _.has(response.headers, "x-meteor-session")) {
-            auth.setSessionId(config.getAccountsDomain(),
-                              response.headers['x-meteor-session']);
-          }
+    // 60 seconds of idle time between response chunks; disable by
+    // passing anything other than a positive number, e.g. {timeout: null}.
+    var idleTimeoutMs = 60 * 1000 * timeoutScaleFactor;
+    if (_.has(options, "timeout")) {
+      idleTimeoutMs =
+        (typeof options.timeout === "number" && options.timeout > 0)
+          ? options.timeout
+          : null;
+    }
 
-          resolve({
-            response: response,
-            body: body,
-            setCookie: setCookie
-          });
-        };
+    var url = options.url;
+    if (options.qs && Object.keys(options.qs).length > 0) {
+      var search = new URLSearchParams();
+      Object.entries(options.qs).forEach(function ([k, v]) {
+        if (v !== undefined && v !== null) {
+          search.append(k, String(v));
+        }
       });
+      var qsString = search.toString();
+      if (qsString) {
+        url += (url.includes('?') ? '&' : '?') + qsString;
+      }
     }
 
-    // try to get proxy from environment.
-    // similar code is in packages/ddp/stream_client_nodejs.js
-    var proxy = process.env.HTTP_PROXY || process.env.http_proxy || null;
-    // if we're going to an https url, try the https_proxy env variable first.
-    if (/^https/i.test(options.url)) {
-      proxy = process.env.HTTPS_PROXY || process.env.https_proxy || proxy;
-    }
-    if (proxy && !options.proxy) {
-      options.proxy = proxy;
+    var totalProgress = {
+      current: 0,
+      end: bodyStreamLength + responseLength,
+      done: false,
+    };
+    function reportProgress() {
+      if (progress && !totalProgress.done) {
+        progress.reportProgress(totalProgress);
+      }
     }
 
-    if (! _.has(options, "timeout")) {
-      // 60 seconds for timeout between initial response headers and data,
-      // and between chunks of data while reading the rest of the response.
-      options.timeout = 60 * 1000 * timeoutScaleFactor;
-    } else if (! (typeof options.timeout === "number" &&
-                  options.timeout > 0)) {
-      // The timeout can be disabled by passing anything other than a
-      // positive number, e.g. { timeout: null }.
-      delete options.timeout;
-    }
+    Console.debug("Doing HTTP request: ", options.method || 'GET', url);
 
-    let onRequest;
-    if (_.has(options, "onRequest")) {
-      onRequest = options.onRequest;
-      delete options.onRequest;
-    }
+    // undici, not Node's global fetch: we need dispatcher control
+    // (proxy/CA) and the same fetch implementation regardless of what
+    // the embedding process did to globalThis.fetch.
+    var undici = require('undici');
 
-    // request is the most heavy-weight of the tool's npm dependencies; don't
-    // require it until we definitely need it.
-    Console.debug("Doing HTTP request: ", options.method || 'GET', options.url);
-    var request = require('request');
-    var req = request(options, function (error, response, body) {
-      if (! error &&
-          response &&
-          (typeof body === "string" ||
-           Buffer.isBuffer(body))) {
-        const contentLength = Number(response.headers["content-length"]);
-        const actualLength = Buffer.byteLength(body);
-
-        if (contentLength > 0 &&
-            actualLength < contentLength) {
-          error = new Error(
-            "Expected " + contentLength + " bytes in request body " +
-              "but received only " + actualLength);
+    var promise = (async () => {
+      var controller = new AbortController();
+      var idleTimer = null;
+      function armIdleTimer() {
+        if (idleTimeoutMs == null) {
+          return;
+        }
+        if (idleTimer) {
+          clearTimeout(idleTimer);
+        }
+        idleTimer = setTimeout(function () {
+          controller.abort(new Error(
+            "HTTP request idle-timed out after " + idleTimeoutMs + "ms: " + url
+          ));
+        }, idleTimeoutMs);
+        // Don't hold the event loop open just for the timeout.
+        if (idleTimer.unref) {
+          idleTimer.unref();
         }
       }
 
-      return callback.call(this, error, response, body);
-    });
-
-    if (_.isFunction(onRequest)) {
-      onRequest(req);
-    }
-
-    var totalProgress = { current: 0, end: bodyStreamLength + responseLength, done: false };
-
-    if (bodyStream) {
-      var dest = req;
-      if (progress) {
-        dest = new WritableWithProgress(dest, function (n, done) {
-          if (!totalProgress.done) {
-            totalProgress.current += n;
-            progress.reportProgress(totalProgress);
-          }
+      var fetchBody;
+      if (bodyStream) {
+        var uploaded = 0;
+        fetchBody = streamWithProgress(bodyStream, function (n) {
+          uploaded += n;
+          totalProgress.current = Math.min(uploaded, bodyStreamLength);
+          reportProgress();
         });
+      } else if (_.has(options, 'body')) {
+        fetchBody = options.body;
       }
-      bodyStream.pipe(dest);
-    }
 
-    if (outputStream) {
-      req.pipe(outputStream);
-    }
-
-    if (progress) {
-      httpHelpers._addProgressEvents(req);
-      req.on('progress', function (state) {
-        if (!totalProgress.done) {
-          totalProgress.current = bodyStreamLength + state.current;
-          totalProgress.end = bodyStreamLength + state.end;
-          totalProgress.done = state.done;
+      var res;
+      try {
+        armIdleTimer();
+        res = await undici.fetch(url, {
+          method: options.method || 'GET',
+          headers: headers,
+          body: fetchBody,
+          // See the redirect comment in this function's doc block.
+          redirect: 'manual',
+          signal: controller.signal,
+          dispatcher: buildDispatcher(url, undici),
+          ...(bodyStream ? { duplex: 'half' } : null),
+        });
 
-          progress.reportProgress(totalProgress);
+        // Response shape: the subset of the old request-package response
+        // object our callers actually read.
+        var headerObj = {};
+        res.headers.forEach(function (value, key) {
+          headerObj[key.toLowerCase()] = value;
+        });
+        var setCookieList = typeof res.headers.getSetCookie === 'function'
+          ? res.headers.getSetCookie()
+          : [];
+        if (setCookieList.length) {
+          headerObj['set-cookie'] = setCookieList;
         }
-      });
-    }
+        var response = {
+          statusCode: res.status,
+          headers: headerObj,
+          request: { href: url },
+        };
 
-    if (promise) {
-      return promise.finally(() => progress && progress.reportProgressDone());
-    } else {
-      return req;
-    }
-  },
+        // Stream the response body: to outputStream when given (body
+        // stays unbuffered), else into memory.
+        var collected = outputStream ? null : [];
+        var received = 0;
+        if (res.body) {
+          for await (const chunk of res.body) {
+            armIdleTimer();
+            var buf = Buffer.from(chunk);
+            received += buf.length;
+            if (outputStream) {
+              outputStream.write(buf);
+            } else {
+              collected.push(buf);
+            }
+            totalProgress.current = bodyStreamLength + received;
+            var contentLength = Number(headerObj['content-length']);
+            totalProgress.end = bodyStreamLength +
+              (contentLength > 0 ? contentLength : Math.max(received, responseLength));
+            reportProgress();
+          }
+        }
+        totalProgress.done = true;
+
+        var body;
+        if (!outputStream) {
+          var bodyBuffer = Buffer.concat(collected);
+          var expected = Number(headerObj['content-length']);
+          if (expected > 0 && bodyBuffer.length < expected) {
+            throw new Error(
+              "Expected " + expected + " bytes in request body " +
+                "but received only " + bodyBuffer.length);
+          }
+          body = options.encoding === null
+            ? bodyBuffer
+            : bodyBuffer.toString('utf8');
+          if (options.json) {
+            body = body.length ? JSON.parse(body) : undefined;
+          }
+        }
 
-  // Adds progress callbacks to a request
-  // Based on request-progress
-  _addProgressEvents: function (request) {
-    var state = {};
+        var setCookie = {};
+        setCookieList.forEach(function (h) {
+          var match = h.match(/^([^=\s]+)=([^;\s]+)/);
+          if (match) {
+            setCookie[match[1]] = match[2];
+          }
+        });
 
-    var emitProgress = function () {
-      request.emit('progress', state);
-    };
+        if (useSessionHeader && _.has(headerObj, "x-meteor-session")) {
+          auth.setSessionId(config.getAccountsDomain(),
+                            headerObj['x-meteor-session']);
+        }
 
-    request
-      .on('response', function (response) {
-        state.end = undefined;
-        state.done = false;
-        state.current = 0;
-        var contentLength = response.headers['content-length'];
-        if (contentLength) {
-          state.end = Number(contentLength);
+        return { response: response, body: body, setCookie: setCookie };
+      } finally {
+        if (idleTimer) {
+          clearTimeout(idleTimer);
         }
-        emitProgress();
-      })
-      .on('data', function (data) {
-        state.current += data.length;
-        emitProgress();
-      })
-      .on('end', function (data) {
-        state.done = true;
-        emitProgress();
-      });
+        if (progress) {
+          progress.reportProgressDone();
+        }
+      }
+    })();
+
+    if (callback) {
+      promise.then(
+        function (result) {
+          callback(null, result.response, result.body);
+        },
+        function (err) {
+          callback(err);
+        }
+      );
+      return undefined;
+    }
+    return promise;
   },
 
-  // A synchronous wrapper around request(...) that returns the response "body"
-  // or throws.
-  //
-  // (This has gone through a few refactors and it might be possible
-  // to fully roll it into httpHelpers.request() at this point.)
+  // Returns the response body or throws; network-level failures become
+  // files.OfflineError.
   getUrl: async function (urlOrOptions) {
     try {
       var result = await httpHelpers.request(urlOrOptions);
@@ -426,10 +415,13 @@ Object.assign(exports, {
 
   // More or less as above, except with support for multiple attempts per
   // request and resuming on retries. This means if the connection is bad,
-  // we can sometimes complete a request, even if each individual attempt fails.
-  // We only use this for package downloads. In theory we could use it for
-  // all requests but that seems like overkill and it isn't well tested in
-  // other scenarioes.
+  // we can sometimes complete a request, even if each individual attempt
+  // fails. We only use this for package downloads.
+  //
+  // (Historical note: the request-package version of this had retry
+  // logic that could never fire -- its try/catch wrapped a Promise
+  // construction, so async rejections bypassed it entirely. This
+  // version actually retries.)
   async getUrlWithResuming(urlOrOptions) {
     const options = _.isObject(urlOrOptions) ? _.clone(urlOrOptions) : {
       url: urlOrOptions,
@@ -446,50 +438,56 @@ Object.assign(exports, {
     const masterProgress = options.progress;
     const outputStream = new ConcatStream();
 
-    function attempt(triesRemaining = maxAttempts, startAt = 0) {
+    let triesRemaining = maxAttempts;
+    let result;
+    for (;;) {
+      const startAt = outputStream.size;
+      const attemptOptions = Object.assign({}, options, { outputStream });
       if (startAt > 0) {
-        options.headers = {
+        attemptOptions.headers = {
           ...options.headers,
-          Range: `bytes=${startAt}-`
+          Range: `bytes=${startAt}-`,
         };
       }
-
-      if (masterProgress &&
-          masterProgress.addChildTask) {
-        options.progress = masterProgress.addChildTask({
-          title: masterProgress.title
+      if (masterProgress && masterProgress.addChildTask) {
+        attemptOptions.progress = masterProgress.addChildTask({
+          title: masterProgress.title,
         });
       }
 
       try {
-        return Promise.resolve(httpHelpers.request({
-          outputStream,
-          ...options,
-        }));
-
+        result = await httpHelpers.request(attemptOptions);
+        // A server that ignored our Range restarted from byte 0 -- the
+        // stream got the full body appended after the partial prefix.
+        // Detect and keep only the fresh copy.
+        if (startAt > 0 && result.response.statusCode === 200) {
+          const full = outputStream.getBuffer().slice(startAt);
+          outputStream.reset();
+          outputStream.write(full);
+        }
+        break;
       } catch (e) {
         const size = outputStream.size;
-        const useTry = size === startAt;
-        const change = size - startAt;
+        const madeProgress = size > startAt;
 
-        if (!useTry || triesRemaining > 0) {
-          if (useTry) {
-            Console.debug(`Request failed, ${triesRemaining - 1} attempts left`);
+        if (madeProgress || triesRemaining > 1) {
+          if (!madeProgress) {
+            triesRemaining -= 1;
+            Console.debug(`Request failed, ${triesRemaining} attempts left`);
           } else {
-            Console.debug(`Request failed after ${change} bytes, retrying`);
+            Console.debug(
+              `Request failed after ${size - startAt} bytes, retrying`);
           }
-
-          return new Promise(
-            resolve => setTimeout(resolve, retryDelaySecs * 1000)
-          ).then(() => attempt(triesRemaining - (useTry ? 1 : 0), size));
+          await new Promise(
+            resolve => setTimeout(resolve, retryDelaySecs * 1000));
+          continue;
         }
 
         Console.debug(`Request failed ${maxAttempts} times: failing`);
-        return Promise.reject(new files.OfflineError(e));
+        throw new files.OfflineError(e);
       }
     }
 
-    const result = await attempt();
     const response = result.response;
     if (response.statusCode >= 400 && response.statusCode < 600) {
       const href = response.request.href;