@maka/meteor-sdk 0.2.3 → 0.2.4

package/isopackets/combined/npm/node_modules/meteor/babel-compiler/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-6xobneyfbqr",
+  "name": "package-new-1snkx7vjcuf",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/boilerplate-generator/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-r3e8f88flkl",
+  "name": "package-new-4u9fx8mbxny",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/constraint-solver/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-4pbying366l",
+  "name": "package-new-sm91z7t3z4o",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ddp-client/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-w88s7v8a2tb",
+  "name": "package-new-gsvm5rcc2iq",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-f69i13ow6p7",
+  "name": "package-new-3gg4doz5i88",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript-runtime/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-p1w5mkk0978",
+  "name": "package-new-1nb1rwir7xu",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript-runtime-client/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1ib48dwuck5",
+  "name": "package-new-1jo8olhxkjm",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript-runtime-server/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1157kjfj2gw",
+  "name": "package-new-2ybexym7dno",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/fetch/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1wg8ssdz0fmf",
+  "name": "package-new-i9b1vaovh2j",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/inter-process-messaging/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1vnwfx4b68v",
+  "name": "package-new-dymdsziwayf",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/logging/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-kid7k7quu7",
+  "name": "package-new-ffz4udz1rzl",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/logic-solver/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1a6dsn3qfc2",
+  "name": "package-new-1gj1i1e8erq",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/meteor/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-v6v3rjtfql",
+  "name": "package-new-1hynmr3gjvhf",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/modules/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1lii7blq24r",
+  "name": "package-new-1ffagznc9qh",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/modules-runtime/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1wg5bygb6ij",
+  "name": "package-new-e37v0zigxr6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/npm-mongo/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-uir4qgmp1sp",
+  "name": "package-new-wfebwy06fwm",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/package-version-parser/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-461z05pva2w",
+  "name": "package-new-dbv0mrj9kh",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/promise/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-23rno2x3x0o",
+  "name": "package-new-4rd6cn8q4z7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/react-fast-refresh/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1w81jifsunlg",
+  "name": "package-new-m44yzrtc8cq",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/socket-stream-client/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1b9umwwq6uc",
+  "name": "package-new-c4g2z219k47",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maka/meteor-sdk",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Programmatic Node API over the Meteor build tool (bundle/run/create/etc.) -- for driving Meteor's build system from plain Node code instead of shelling out to a meteor CLI (there isn't one anymore; see README.md). \"dependencies\" is generated by scripts/write-tool-package-json.js from scripts/dev-bundle-tool-package.js at the monorepo root -- do not hand-edit that field, edit that file and re-run the script instead.",
   "main": "src/index.js",
   "exports": {
@@ -44,7 +44,7 @@
     "source-map-v01": "npm:source-map@0.1.32",
     "@types/semver": "7.5.8",
     "semver": "7.6.3",
-    "request": "2.88.2",
+    "undici": "8.10.0",
     "graceful-fs": "4.2.11",
     "tar-fs": "2.1.1",
     "source-map": "0.7.4",
@@ -54,7 +54,7 @@
     "is-reachable": "3.1.0",
     "wordwrap": "1.0.0",
     "moment": "2.30.1",
-    "glob": "11.1.0",
+    "glob": "13.0.6",
     "ignore": "7.0.5",
     "commonmark": "0.15.0",
     "escope": "4.0.0",

package/tools/utils/http-helpers.js

@@ -1,6 +1,15 @@
 ///
 /// utility functions for dealing with urls and http
 ///
+/// Implemented on undici's fetch (the engine behind Node's own global
+/// fetch) rather than the long-deprecated `request` package -- request
+/// dragged har-validator and uuid@3 (both deprecation-flagged on every
+/// consumer install) and has been unmaintained since 2020. The public
+/// surface here (request/getUrl/getUrlWithResuming and their option
+/// shapes) is preserved for the nine in-tree callers; see the audit in
+/// the git history of this rewrite for exactly which options each
+/// caller uses.
+///
 
 var os = require('os');
 var util = require('util');
@@ -38,6 +47,13 @@ class ConcatStream extends Writable {
     return this.chunks[0];
   }
 
+  // A resumed download whose server ignored our Range header restarts
+  // from byte 0 -- drop what we had so we don't concatenate duplicates.
+  reset() {
+    this.chunks = [];
+    this.size = 0;
+  }
+
   end(force = false) {
     // Override the Writable#end method to ignore any .end() calls for
     // this stream, since we likely want to resume the download later.
@@ -47,51 +63,6 @@ class ConcatStream extends Writable {
   }
 }
 
-// Helper that tracks bytes written to a writable
-var WritableWithProgress = function (writable, listener) {
-  var self = this;
-  self._inner = writable;
-  self._listener = listener;
-};
-
-Object.assign(WritableWithProgress.prototype, {
-  write: function (chunk, encoding, callback) {
-    var self = this;
-    self._listener(chunk.length, false);
-    return self._inner.write(chunk, encoding);
-  },
-
-  end: function (chunk, encoding, callback) {
-    var self = this;
-    self._listener(chunk ? chunk.length : 0, true);
-    return self._inner.end(chunk, encoding);
-  },
-
-  _progress: function (n, done) {
-    var self = this;
-
-    var state = self._state;
-    state.current += n;
-    if (done) {
-      state.current.done = true;
-    }
-    self.progress.reportProgress(state);
-  },
-
-  on: function (name, callback) {
-    return this._inner.on(name, callback);
-  },
-
-  once: function () {
-    return this._inner.once(...arguments);
-  },
-
-  emit: function () {
-    return this._inner.emit(...arguments);
-  }
-});
-
-
 // Compose a User-Agent header.
 var getUserAgent = function () {
   var version;
@@ -111,45 +82,70 @@ var getUserAgent = function () {
                      os.platform(), os.type(), os.release(), os.arch());
 };
 
+// Builds the undici dispatcher for this request: env-var proxy support
+// (same env semantics the request package had, and the same explicit
+// detection packages/socket-stream-client uses) and CAFILE support.
+function buildDispatcher(url, undici) {
+  var proxy = process.env.HTTP_PROXY || process.env.http_proxy || null;
+  if (/^https/i.test(url)) {
+    proxy = process.env.HTTPS_PROXY || process.env.https_proxy || proxy;
+  }
+
+  var connect;
+  if (process.env.CAFILE) {
+    connect = { ca: files.readFile(process.env.CAFILE) };
+  }
+
+  if (proxy) {
+    return new undici.ProxyAgent(
+      connect ? { uri: proxy, connect } : { uri: proxy }
+    );
+  }
+  if (connect) {
+    return new undici.Agent({ connect });
+  }
+  return undefined;
+}
+
+// Wraps a Node Readable request body in an async generator that reports
+// upload progress per chunk.
+async function* streamWithProgress(bodyStream, onChunk) {
+  for await (const chunk of bodyStream) {
+    onChunk(chunk.length);
+    yield chunk;
+  }
+}
 
 var httpHelpers = exports;
 Object.assign(exports, {
   getUserAgent: getUserAgent,
 
-  // A wrapper around request with the following improvements:
+  // A fetch-based replacement for the old request-package wrapper, with
+  // the same contract:
   //
-  // - It will respect proxy environment variables if present
-  //   (HTTP_PROXY or HTTPS_PROXY as appropriate).
+  // - Respects HTTP_PROXY/HTTPS_PROXY, sets a Meteor User-Agent, honors
+  //   $CAFILE for a custom CA.
   //
-  // - It will set a reasonable User-Agent header.
+  // - Never follows redirects (fetch redirect: "manual"): redirects
+  //   don't segregate cookies/headers by origin, and callers like the
+  //   OAuth flow in auth.js depend on seeing the 302 themselves.
   //
-  // - If you omit the callback it will run synchronously. The return
-  //   value will be an object with keys 'response' and 'body' (with
-  //   the same meaning as the arguments to request's normal
-  //   callback), or it will throw.
+  // - Options: url (or a bare url string instead of the object), method,
+  //   headers, qs (object appended to the url as a query string),
+  //   json: true (parse the response body as JSON), encoding
+  //   (null => body is a Buffer; anything else => utf8 string, the
+  //   default), bodyStream (+ bodyStreamLength) for a streamed request
+  //   body, outputStream to stream the response body into (body is not
+  //   buffered then), progress (a progress tracker; incompatible with
+  //   callback), timeout (idle ms between response chunks; default 60s,
+  //   disable by passing a non-positive/non-number), useSessionHeader /
+  //   useAuthHeader for the Meteor services session file.
   //
-  // - If Set-Cookie headers are present on the response, *and* you
-  //   are using a callback, it will parse the cookies and include
-  //   them as a setCookie attribute on the object passed to the
-  //   callback. setCookie is a simple map from cookie name to cookie
-  //   value. If you want expiration time and attributes you'll have
-  //   to parse it yourself. If there are multiple Set-Cookie headers
-  //   for the same cookie it is unspecified which one you'll get.
-  //
-  // - You can provide a 'bodyStream' option which is a stream that
-  //   will be used for the body of the request.
-  //
-  // - For authenticated Meteor Software services, you can set the
-  //   'useSessionHeader' and/or 'useAuthHeader' options (to true) to
-  //   send X-Meteor-Session/X-Meteor-Auth headers using values from
-  //   the session file.
-  //
-  // - forceSSL is always set to true. Always. And followRedirect is
-  //   set to false since it doesn't understand origins (see comment
-  //   in implementation).
-  //
-  // - An optional options.onRequest callback may be provided if the
-  //   caller desires access to the request object.
+  // - Without a callback, returns a Promise of { response, body,
+  //   setCookie }. response is a plain object: { statusCode, headers
+  //   (lowercased plain object), request: { href } } -- the subset of
+  //   the old request response our callers read. With a callback, calls
+  //   callback(err, response, body) instead.
   //
   // NB: With useSessionHeader and useAuthHeader, this function will
   // read *and possibly write to* the session file, so if you are
@@ -163,75 +159,41 @@ Object.assign(exports, {
       options = _.clone(urlOrOptions);
     }
 
-    var outputStream;
-    if (_.has(options, 'outputStream')) {
-      outputStream = options.outputStream;
-      delete options.outputStream;
-    }
-
-    var bodyStream;
-    if (_.has(options, 'bodyStream')) {
-      bodyStream = options.bodyStream;
-      delete options.bodyStream;
-    }
+    var outputStream = options.outputStream;
+    var bodyStream = options.bodyStream;
 
     // Body stream length for progress
     var bodyStreamLength = 0;
     if (_.has(options, 'bodyStreamLength')) {
       bodyStreamLength = options.bodyStreamLength;
-      delete options.bodyStreamLength;
-    } else {
+    } else if (bodyStream) {
       // Guess the body stream length as 1MB
       // Hopefully if it's much bigger the caller will set it
       // If it is much small, we will pleasantly surprise the user!
-      if (bodyStream) {
-        bodyStreamLength = 1024 * 1024;
-      }
+      bodyStreamLength = 1024 * 1024;
     }
 
     // Response length for progress
     var responseLength = 128 * 1024;
     if (_.has(options, 'responseLength')) {
       responseLength = options.responseLength;
-      delete options.responseLength;
     }
 
-    var progress = null;
-    if (_.has(options, 'progress')) {
-      progress = options.progress;
-      delete options.progress;
-
-      if (callback) {
-        throw new Error("Not safe to use progress with callback");
-      }
+    var progress = options.progress || null;
+    if (progress && callback) {
+      throw new Error("Not safe to use progress with callback");
     }
 
-    options.headers = Object.assign({
+    var headers = Object.assign({
       'User-Agent': getUserAgent()
     }, options.headers || {});
 
-    // This should never, ever be false, or else why are you using SSL?
-    options.forceSSL = true;
-    if (process.env.CAFILE) {
-      options.ca = files.readFile(process.env.CAFILE);
-    }
-
-    // followRedirect is very dangerous because request does not
-    // appear to segregate cookies by origin, so any cookies (and
-    // apparently headers as well, eg X-Meteor-Auth) sent on the
-    // original request could get forwarded to an unexpected domain in
-    // a redirect. This is almost certainly not something you ever
-    // want.
-    options.followRedirect = false;
-
     var useSessionHeader = options.useSessionHeader;
-    delete options.useSessionHeader;
     var useAuthHeader = options.useAuthHeader;
-    delete options.useAuthHeader;
     if (useSessionHeader || useAuthHeader) {
       var sessionHeader = auth.getSessionId(config.getAccountsDomain());
       if (sessionHeader) {
-        options.headers['X-Meteor-Session'] = sessionHeader;
+        headers['X-Meteor-Session'] = sessionHeader;
       }
       if (callback) {
         throw new Error("session header can't be used with callback");
@@ -240,170 +202,197 @@ Object.assign(exports, {
     if (useAuthHeader) {
       var authHeader = auth.getSessionToken(config.getAccountsDomain());
       if (authHeader) {
-        options.headers['X-Meteor-Auth'] = authHeader;
+        headers['X-Meteor-Auth'] = authHeader;
       }
     }
 
-    var promise;
-    if (! callback) {
-      promise = new Promise(function (resolve, reject) {
-        callback = function (err, response, body) {
-          if (err) {
-            reject(err);
-            return;
-          }
-
-          var setCookie = {};
-          _.each(response.headers["set-cookie"] || [], function (h) {
-            var match = h.match(/^([^=\s]+)=([^;\s]+)/);
-            if (match) {
-              setCookie[match[1]] = match[2];
-            }
-          });
-
-          if (useSessionHeader && _.has(response.headers, "x-meteor-session")) {
-            auth.setSessionId(config.getAccountsDomain(),
-                              response.headers['x-meteor-session']);
-          }
+    // 60 seconds of idle time between response chunks; disable by
+    // passing anything other than a positive number, e.g. {timeout: null}.
+    var idleTimeoutMs = 60 * 1000 * timeoutScaleFactor;
+    if (_.has(options, "timeout")) {
+      idleTimeoutMs =
+        (typeof options.timeout === "number" && options.timeout > 0)
+          ? options.timeout
+          : null;
+    }
 
-          resolve({
-            response: response,
-            body: body,
-            setCookie: setCookie
-          });
-        };
+    var url = options.url;
+    if (options.qs && Object.keys(options.qs).length > 0) {
+      var search = new URLSearchParams();
+      Object.entries(options.qs).forEach(function ([k, v]) {
+        if (v !== undefined && v !== null) {
+          search.append(k, String(v));
+        }
       });
+      var qsString = search.toString();
+      if (qsString) {
+        url += (url.includes('?') ? '&' : '?') + qsString;
+      }
     }
 
-    // try to get proxy from environment.
-    // similar code is in packages/ddp/stream_client_nodejs.js
-    var proxy = process.env.HTTP_PROXY || process.env.http_proxy || null;
-    // if we're going to an https url, try the https_proxy env variable first.
-    if (/^https/i.test(options.url)) {
-      proxy = process.env.HTTPS_PROXY || process.env.https_proxy || proxy;
-    }
-    if (proxy && !options.proxy) {
-      options.proxy = proxy;
+    var totalProgress = {
+      current: 0,
+      end: bodyStreamLength + responseLength,
+      done: false,
+    };
+    function reportProgress() {
+      if (progress && !totalProgress.done) {
+        progress.reportProgress(totalProgress);
+      }
     }
 
-    if (! _.has(options, "timeout")) {
-      // 60 seconds for timeout between initial response headers and data,
-      // and between chunks of data while reading the rest of the response.
-      options.timeout = 60 * 1000 * timeoutScaleFactor;
-    } else if (! (typeof options.timeout === "number" &&
-                  options.timeout > 0)) {
-      // The timeout can be disabled by passing anything other than a
-      // positive number, e.g. { timeout: null }.
-      delete options.timeout;
-    }
+    Console.debug("Doing HTTP request: ", options.method || 'GET', url);
 
-    let onRequest;
-    if (_.has(options, "onRequest")) {
-      onRequest = options.onRequest;
-      delete options.onRequest;
-    }
+    // undici, not Node's global fetch: we need dispatcher control
+    // (proxy/CA) and the same fetch implementation regardless of what
+    // the embedding process did to globalThis.fetch.
+    var undici = require('undici');
 
-    // request is the most heavy-weight of the tool's npm dependencies; don't
-    // require it until we definitely need it.
-    Console.debug("Doing HTTP request: ", options.method || 'GET', options.url);
-    var request = require('request');
-    var req = request(options, function (error, response, body) {
-      if (! error &&
-          response &&
-          (typeof body === "string" ||
-           Buffer.isBuffer(body))) {
-        const contentLength = Number(response.headers["content-length"]);
-        const actualLength = Buffer.byteLength(body);
-
-        if (contentLength > 0 &&
-            actualLength < contentLength) {
-          error = new Error(
-            "Expected " + contentLength + " bytes in request body " +
-              "but received only " + actualLength);
+    var promise = (async () => {
+      var controller = new AbortController();
+      var idleTimer = null;
+      function armIdleTimer() {
+        if (idleTimeoutMs == null) {
+          return;
+        }
+        if (idleTimer) {
+          clearTimeout(idleTimer);
+        }
+        idleTimer = setTimeout(function () {
+          controller.abort(new Error(
+            "HTTP request idle-timed out after " + idleTimeoutMs + "ms: " + url
+          ));
+        }, idleTimeoutMs);
+        // Don't hold the event loop open just for the timeout.
+        if (idleTimer.unref) {
+          idleTimer.unref();
         }
       }
 
-      return callback.call(this, error, response, body);
-    });
-
-    if (_.isFunction(onRequest)) {
-      onRequest(req);
-    }
-
-    var totalProgress = { current: 0, end: bodyStreamLength + responseLength, done: false };
-
-    if (bodyStream) {
-      var dest = req;
-      if (progress) {
-        dest = new WritableWithProgress(dest, function (n, done) {
-          if (!totalProgress.done) {
-            totalProgress.current += n;
-            progress.reportProgress(totalProgress);
-          }
+      var fetchBody;
+      if (bodyStream) {
+        var uploaded = 0;
+        fetchBody = streamWithProgress(bodyStream, function (n) {
+          uploaded += n;
+          totalProgress.current = Math.min(uploaded, bodyStreamLength);
+          reportProgress();
         });
+      } else if (_.has(options, 'body')) {
+        fetchBody = options.body;
       }
-      bodyStream.pipe(dest);
-    }
 
-    if (outputStream) {
-      req.pipe(outputStream);
-    }
-
-    if (progress) {
-      httpHelpers._addProgressEvents(req);
-      req.on('progress', function (state) {
-        if (!totalProgress.done) {
-          totalProgress.current = bodyStreamLength + state.current;
-          totalProgress.end = bodyStreamLength + state.end;
-          totalProgress.done = state.done;
+      var res;
+      try {
+        armIdleTimer();
+        res = await undici.fetch(url, {
+          method: options.method || 'GET',
+          headers: headers,
+          body: fetchBody,
+          // See the redirect comment in this function's doc block.
+          redirect: 'manual',
+          signal: controller.signal,
+          dispatcher: buildDispatcher(url, undici),
+          ...(bodyStream ? { duplex: 'half' } : null),
+        });
 
-          progress.reportProgress(totalProgress);
+        // Response shape: the subset of the old request-package response
+        // object our callers actually read.
+        var headerObj = {};
+        res.headers.forEach(function (value, key) {
+          headerObj[key.toLowerCase()] = value;
+        });
+        var setCookieList = typeof res.headers.getSetCookie === 'function'
+          ? res.headers.getSetCookie()
+          : [];
+        if (setCookieList.length) {
+          headerObj['set-cookie'] = setCookieList;
         }
-      });
-    }
+        var response = {
+          statusCode: res.status,
+          headers: headerObj,
+          request: { href: url },
+        };
 
-    if (promise) {
-      return promise.finally(() => progress && progress.reportProgressDone());
-    } else {
-      return req;
-    }
-  },
+        // Stream the response body: to outputStream when given (body
+        // stays unbuffered), else into memory.
+        var collected = outputStream ? null : [];
+        var received = 0;
+        if (res.body) {
+          for await (const chunk of res.body) {
+            armIdleTimer();
+            var buf = Buffer.from(chunk);
+            received += buf.length;
+            if (outputStream) {
+              outputStream.write(buf);
+            } else {
+              collected.push(buf);
+            }
+            totalProgress.current = bodyStreamLength + received;
+            var contentLength = Number(headerObj['content-length']);
+            totalProgress.end = bodyStreamLength +
+              (contentLength > 0 ? contentLength : Math.max(received, responseLength));
+            reportProgress();
+          }
+        }
+        totalProgress.done = true;
+
+        var body;
+        if (!outputStream) {
+          var bodyBuffer = Buffer.concat(collected);
+          var expected = Number(headerObj['content-length']);
+          if (expected > 0 && bodyBuffer.length < expected) {
+            throw new Error(
+              "Expected " + expected + " bytes in request body " +
+                "but received only " + bodyBuffer.length);
+          }
+          body = options.encoding === null
+            ? bodyBuffer
+            : bodyBuffer.toString('utf8');
+          if (options.json) {
+            body = body.length ? JSON.parse(body) : undefined;
+          }
+        }
 
-  // Adds progress callbacks to a request
-  // Based on request-progress
-  _addProgressEvents: function (request) {
-    var state = {};
+        var setCookie = {};
+        setCookieList.forEach(function (h) {
+          var match = h.match(/^([^=\s]+)=([^;\s]+)/);
+          if (match) {
+            setCookie[match[1]] = match[2];
+          }
+        });
 
-    var emitProgress = function () {
-      request.emit('progress', state);
-    };
+        if (useSessionHeader && _.has(headerObj, "x-meteor-session")) {
+          auth.setSessionId(config.getAccountsDomain(),
+                            headerObj['x-meteor-session']);
+        }
 
-    request
-      .on('response', function (response) {
-        state.end = undefined;
-        state.done = false;
-        state.current = 0;
-        var contentLength = response.headers['content-length'];
-        if (contentLength) {
-          state.end = Number(contentLength);
+        return { response: response, body: body, setCookie: setCookie };
+      } finally {
+        if (idleTimer) {
+          clearTimeout(idleTimer);
         }
-        emitProgress();
-      })
-      .on('data', function (data) {
-        state.current += data.length;
-        emitProgress();
-      })
-      .on('end', function (data) {
-        state.done = true;
-        emitProgress();
-      });
+        if (progress) {
+          progress.reportProgressDone();
+        }
+      }
+    })();
+
+    if (callback) {
+      promise.then(
+        function (result) {
+          callback(null, result.response, result.body);
+        },
+        function (err) {
+          callback(err);
+        }
+      );
+      return undefined;
+    }
+    return promise;
   },
 
-  // A synchronous wrapper around request(...) that returns the response "body"
-  // or throws.
-  //
-  // (This has gone through a few refactors and it might be possible
-  // to fully roll it into httpHelpers.request() at this point.)
+  // Returns the response body or throws; network-level failures become
+  // files.OfflineError.
   getUrl: async function (urlOrOptions) {
     try {
       var result = await httpHelpers.request(urlOrOptions);
@@ -426,10 +415,13 @@ Object.assign(exports, {
 
   // More or less as above, except with support for multiple attempts per
   // request and resuming on retries. This means if the connection is bad,
-  // we can sometimes complete a request, even if each individual attempt fails.
-  // We only use this for package downloads. In theory we could use it for
-  // all requests but that seems like overkill and it isn't well tested in
-  // other scenarioes.
+  // we can sometimes complete a request, even if each individual attempt
+  // fails. We only use this for package downloads.
+  //
+  // (Historical note: the request-package version of this had retry
+  // logic that could never fire -- its try/catch wrapped a Promise
+  // construction, so async rejections bypassed it entirely. This
+  // version actually retries.)
   async getUrlWithResuming(urlOrOptions) {
     const options = _.isObject(urlOrOptions) ? _.clone(urlOrOptions) : {
       url: urlOrOptions,
@@ -446,50 +438,56 @@ Object.assign(exports, {
     const masterProgress = options.progress;
     const outputStream = new ConcatStream();
 
-    function attempt(triesRemaining = maxAttempts, startAt = 0) {
+    let triesRemaining = maxAttempts;
+    let result;
+    for (;;) {
+      const startAt = outputStream.size;
+      const attemptOptions = Object.assign({}, options, { outputStream });
       if (startAt > 0) {
-        options.headers = {
+        attemptOptions.headers = {
           ...options.headers,
-          Range: `bytes=${startAt}-`
+          Range: `bytes=${startAt}-`,
         };
       }
-
-      if (masterProgress &&
-          masterProgress.addChildTask) {
-        options.progress = masterProgress.addChildTask({
-          title: masterProgress.title
+      if (masterProgress && masterProgress.addChildTask) {
+        attemptOptions.progress = masterProgress.addChildTask({
+          title: masterProgress.title,
         });
       }
 
       try {
-        return Promise.resolve(httpHelpers.request({
-          outputStream,
-          ...options,
-        }));
-
+        result = await httpHelpers.request(attemptOptions);
+        // A server that ignored our Range restarted from byte 0 -- the
+        // stream got the full body appended after the partial prefix.
+        // Detect and keep only the fresh copy.
+        if (startAt > 0 && result.response.statusCode === 200) {
+          const full = outputStream.getBuffer().slice(startAt);
+          outputStream.reset();
+          outputStream.write(full);
+        }
+        break;
       } catch (e) {
         const size = outputStream.size;
-        const useTry = size === startAt;
-        const change = size - startAt;
+        const madeProgress = size > startAt;
 
-        if (!useTry || triesRemaining > 0) {
-          if (useTry) {
-            Console.debug(`Request failed, ${triesRemaining - 1} attempts left`);
+        if (madeProgress || triesRemaining > 1) {
+          if (!madeProgress) {
+            triesRemaining -= 1;
+            Console.debug(`Request failed, ${triesRemaining} attempts left`);
           } else {
-            Console.debug(`Request failed after ${change} bytes, retrying`);
+            Console.debug(
+              `Request failed after ${size - startAt} bytes, retrying`);
           }
-
-          return new Promise(
-            resolve => setTimeout(resolve, retryDelaySecs * 1000)
-          ).then(() => attempt(triesRemaining - (useTry ? 1 : 0), size));
+          await new Promise(
+            resolve => setTimeout(resolve, retryDelaySecs * 1000));
+          continue;
         }
 
         Console.debug(`Request failed ${maxAttempts} times: failing`);
-        return Promise.reject(new files.OfflineError(e));
+        throw new files.OfflineError(e);
       }
     }
 
-    const result = await attempt();
     const response = result.response;
     if (response.statusCode >= 400 && response.statusCode < 600) {
       const href = response.request.href;