@preventive/triage 1.0.0-alpha.36 → 1.0.0-alpha.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.36",
+  "version": "1.0.0-alpha.37",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {

package/server-managed/bundle-build-worker.js

@@ -58,7 +58,7 @@ export async function buildStasisBundle({ input, github, token, maxBytes, scopes
   } }
   // Upstream's disk cache keeps the npm tarballs and version documents, and
   // the repo's tree, in `cacheDir`; without one (Vercel), nothing is kept on
-  // disk. This fresh worker inherits no application credentials.
+  // disk. This fresh worker inherits no application credentials but NPM_TOKEN.
   setCacheDir(cacheDir ?? false)
   progress('build')
   const project = await projectDirectory(input, github, buildClient)

package/server-managed/bundle-build.ts

@@ -99,7 +99,7 @@ export interface BuiltBundle { bytes: Uint8Array; directory: string; filename: s
 export interface BuildRequest {
   input: BundleBuildInput; github: string; token: string | null; maxBytes: number; scopes: (string | null)[]
   // Upstream's disk cache for what a build fetches (setCacheDir), or null for
-  // none, as on Vercel. Resolved here: the worker runs with an empty env.
+  // none, as on Vercel. Resolved here: the worker's env holds NPM_TOKEN alone.
   cacheDir: string | null
 }
 // An extra per-process ceiling; admission must also hold the shared DB lease.
@@ -152,8 +152,12 @@ export async function buildRepositoryBundle(userId: string, request: BuildReques
   try {
     workerUrl = new URL('./bundle-build-worker.js', import.meta.url)
     log('started')
+    // Upstream reads NPM_TOKEN from the env for scoped packages, which npm
+    // answers with 404 when private and asked without it. Nothing else passes.
+    const npmToken = process.env['NPM_TOKEN']
+    const env = npmToken ? { NPM_TOKEN: npmToken } : {}
     worker = new Worker(workerUrl, {
-      workerData: { ...request, type: 'managed-bundle-build' }, env: {}, execArgv: [], resourceLimits: { maxOldGenerationSizeMb: 512 },
+      workerData: { ...request, type: 'managed-bundle-build' }, env, execArgv: [], resourceLimits: { maxOldGenerationSizeMb: 512 },
     })
     const running = worker
     return await new Promise((resolve, reject) => {