@preventive/upstream 1.0.0-alpha.0 → 1.0.0-alpha.10

package/LICENSE-APACHE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/advisories.d.ts

@@ -6,28 +6,32 @@ import type { Client, RepoName } from './github.js'
 export { HttpError } from './npm.js'
 
 // As purl and stasis name them.
-export type Ecosystem = 'npm' | 'cargo' | 'composer' | 'github'
+export type Ecosystem = 'npm' | 'cargo' | 'composer' | 'soldeer' | 'github'
 
 export interface Package {
   ecosystem: Ecosystem
-  // An npm package name, a crate name, a Composer `vendor/name`, or for
-  // `github`, the repository `owner/name` itself.
+  // An npm package name, a crate name, a Composer `vendor/name`, a Soldeer
+  // project name, or for `github`, the repository `owner/name` itself.
   name: string
   // Its GitHub repository, where the caller knows it (package.json,
   // Cargo.toml, installed.json), for `repoAdvisories` to ask without
-  // looking it up; not for `github` packages, which are their own.
+  // looking it up, and for a `soldeer` package, to ask instead of the one
+  // Soldeer names; not for `github` packages, which are their own.
   github?: RepoName
   // npm and `github`: semver; `github` also takes a branch name or 0.0.0,
   // which every range covers. cargo: semver, build metadata allowed.
   // composer: a release (`v1.2.3`, `1.2.3.4`, `2.0.0-RC1`), dev versions
-  // refused; one semver cannot read is covered by every range.
+  // refused; one semver cannot read is covered by every range. soldeer: as
+  // soldeer.lock has it; one semver cannot read (a bare number, a commit)
+  // is covered by every range.
   versions: string[]
 }
 
 export interface AdvisoryOptions {
-  // The client every GitHub request goes through. Required for `github`
-  // packages, whose repository's published advisories are their only
-  // source, and for `repoAdvisories`; by itself it asks nothing else.
+  // The client every GitHub request goes through. Required for `soldeer`
+  // and `github` packages, whose repository's published advisories are
+  // their only source, and for `repoAdvisories`; by itself it asks nothing
+  // else.
   github?: Client
   // Also asks each npm, cargo and composer package's GitHub repository
   // for its published advisories, which it has before GitHub reviews them
@@ -35,6 +39,11 @@ export interface AdvisoryOptions {
   // the one npm's metadata, crates.io or Packagist names, looked up
   // through the cache. Needs `github`.
   repoAdvisories?: boolean
+  // Also returns each advisory's full text, as `details`. OSV's records
+  // and a repository's listing already carry it; npm's registry does not,
+  // and its rows take OSV's record of their GHSA, one more request each
+  // (no GitHub client needed).
+  details?: boolean
 }
 
 // One advisory on one package, with the versions asked about that it
@@ -43,18 +52,36 @@ export interface Advisory {
   ecosystem: Ecosystem
   name: string
   // `registry`: npm's, as `npm audit` has it, one row per vulnerable
-  // range. `osv`: RustSec for cargo, OSV's Packagist records for composer.
+  // range. `osv`: OSV's records for cargo and composer, RustSec's, GitHub's
+  // and malicious packages' (MAL-…) among them; of the records naming each
+  // other as aliases, directly or through others, a version is reported
+  // under one only: RustSec's, else the GHSA, else the first by id. Each
+  // has the others' ids among its aliases.
   // `repository`: published on the package's repository, one row per
   // range, holding only the versions the others' answer does not report
-  // under that GHSA.
+  // under that GHSA. The only source for `soldeer` and `github`, where
+  // every range counts, whichever package it names.
   source: 'registry' | 'osv' | 'repository'
-  // A GHSA, RUSTSEC-…, DRUPAL-CORE-…, or npm:<id> for a registry row
-  // without a GHSA.
+  // A GHSA, RUSTSEC-…, MAL-…, DRUPAL-CORE-… or another OSV id, or
+  // npm:<id> for a registry row without a GHSA.
   id: string
   // The id itself, or an OSV record's one GHSA alias.
   ghsa?: string
+  // GitHub's page for the GHSA, with it: a `repository` row's on its
+  // repository (https://github.com/owner/name/security/advisories/GHSA-…),
+  // which has it before GitHub reviews it into its advisory database; any
+  // other's in that database (https://github.com/advisories/GHSA-…). An
+  // `osv` row without one has osv.dev's page for its record
+  // (https://osv.dev/vulnerability/RUSTSEC-…). Built, never fetched: only
+  // a registry row without a GHSA (npm:<id>) has none.
+  url?: string
   aliases: string[]
   title?: string
+  // With `details`, the advisory's full text, Markdown as published: an
+  // OSV record's `details`, a repository advisory's `description`, or for
+  // a registry row, OSV's record of its GHSA. Absent where there is none:
+  // a registry row without a GHSA, or with one OSV does not have yet.
+  details?: string
   // `critical`, `high`, `moderate`, `low`; GitHub's `medium` reads
   // `moderate`. RustSec has none.
   severity?: string
@@ -75,8 +102,12 @@ export interface Advisory {
 // Every package, and every one of its versions, is checked against its
 // ecosystem's rules before the first request; a name given twice is
 // merged, and must not name two repositories. npm is asked 250 names a
-// request, OSV 1000 versions; a repository gone, renamed or blocked adds
-// nothing. Any other failure, a malformed answer, or one about something
-// not asked, throws: nothing is left out quietly. Sorted by ecosystem and
-// name. Versions are matched by npm's semver, from the npm beside node.
+// request, OSV 1000 versions, Soldeer one project, and with `details`, OSV
+// one GHSA among npm's rows; a project Soldeer does not have or that names
+// no GitHub repository, and a repository gone, renamed or blocked, add
+// nothing, and a GHSA OSV does not have adds no `details`. Any other
+// failure, a malformed answer, or one about something not asked, throws:
+// nothing is left out quietly.
+// Sorted by ecosystem and name. Versions are matched by npm's semver, from
+// the npm beside node, or by the semver peer where there is no npm.
 export function advisories(packages: Iterable<Package>, options?: AdvisoryOptions): Promise<Advisory[]>

package/cargo.d.ts

@@ -0,0 +1,36 @@
+// Hand-written against cargo.js; a change to either belongs with the other.
+//
+// A name is asserted to be a crate name, a version an exact semver
+// version, and a checksum 64 lowercase hex digits, before any request or
+// cache path. The cache is setCacheDir's (npm.js).
+
+export { HttpError } from './npm.js'
+
+// Reads crates.io's index for that version and throws unless its sha256
+// is the one given, as for a checksum read off Cargo.lock. The index is
+// read on every call; nothing is cached.
+export function verifyChecksum(name: string, version: string, checksum: string): Promise<void>
+
+// A published version's .crate, whole, in memory. `checksum` is its
+// sha256 as Cargo.lock records it; without one, crates.io's index is read
+// for it on every call, cached crate or not. Either way the bytes are
+// checked against it, whether they were downloaded from static.crates.io
+// (before they are cached) or read from a cache.
+//
+// Cargo's own cache is read first, and never written: each registry's
+// `<name>-<version>.crate` under $CARGO_HOME/registry/cache, else under
+// `~/.cargo`. A file there that does not match is passed over. One in
+// setCacheDir's cache that does not match throws.
+export function getCrate(name: string, version: string, checksum?: string): Promise<Uint8Array>
+
+// What resolveCrateRepos maps each resolved name to: `owner/name`, the
+// GitHub repo the crate's `repository` on crates.io names.
+export interface CrateRepo {
+  github: string
+}
+// Fail-soft, as npm.js's resolvePackageRepos: a crate crates.io does not
+// have, one naming no GitHub repo, and those of a request that fails are
+// absent from the map. crates.io is asked a hundred names a request, a
+// second apart, as it asks; a repo found is cached for a month, and
+// `cachedOnly` answers from that cache alone and never fetches.
+export function resolveCrateRepos(crateNames: Iterable<string>, options?: { cachedOnly?: boolean }): Promise<Map<string, CrateRepo>>

package/cargo.js

@@ -0,0 +1,3 @@
+export { getCrate, verifyChecksum } from './src/cargo/crate.js'
+export { resolveCrateRepos } from './src/cargo/repos.js'
+export { HttpError } from './src/http.js'

package/github.d.ts

@@ -1,16 +1,17 @@
 // Hand-written against github.js; a change to either belongs with the other.
 //
-// Every method checks its arguments hard before any request is built:
-// an options object holding only the keys listed here, a repo that is
+// Every method checks its arguments hard before any request is built: an
+// options object holding only the keys listed here, a repo that is
 // `owner/name` by GitHub's rules, branches and tags that git would take,
-// full commit shas, paths with no empty, `.` or `..` component, titles
-// and headlines on one line. A bad one is a rejection naming the method;
-// nothing is sent. Every URL is built from checked, encoded segments and
-// has to come back out of URL parsing unchanged. Redirects are refused,
-// except the tarball's, so an answer is about the repo asked for. A
-// response is read up to a size limit (64 MiB of JSON, 128 MiB of a file,
-// 512 MiB of a tarball) and within a timeout (30 seconds, 5 minutes for a
-// tarball), and what it says goes into an error message escaped.
+// full commit shas and tree ids, paths with no empty, `.` or `..`
+// component, titles and headlines on one line. A bad one is a rejection
+// naming the method; nothing is sent. Every URL is built from checked,
+// encoded segments and has to come back out of URL parsing unchanged.
+// Redirects are refused, except the tarballs', so an answer is about the
+// repo asked for. A response is read up to a size limit (64 MiB of JSON,
+// 128 MiB of a file, 512 MiB of a tarball) and within a timeout (30
+// seconds, 5 minutes for a tarball), and what it says goes into an error
+// message escaped.
 
 // `owner/name`.
 export type RepoName = string
@@ -24,6 +25,16 @@ export interface ClientOptions {
 
 export type PullRequestStatus = 'open' | 'draft' | 'closed' | 'merged'
 
+// An entry of a directory, as git has it, `path` its name: a file
+// (`100644`, `100755` executable) or a symlink (`120000`) is a blob, a
+// directory (`040000`) a tree, a submodule (`160000`) the commit it is at.
+export interface RepoDirEntry {
+  path: string
+  mode: '100644' | '100755' | '120000' | '040000' | '160000'
+  type: 'blob' | 'tree' | 'commit'
+  sha: string
+}
+
 // A failed request: `status` is the HTTP status GitHub answered with.
 export class HttpError extends Error {
   name: 'HttpError'
@@ -54,12 +65,55 @@ export interface Client {
   getRepoFile(options: { repo: RepoName; path: string; ref?: string }): Promise<string>
   // The head of `branch`, or of the default branch without one.
   getRepoHead(options: { repo: RepoName; branch?: string }): Promise<{ branch: string; oid: string }>
-  // The repo's gzipped tarball at the full commit `sha`, whole, in memory.
+  // The commit `tag` names: GitHub's ref for exactly that tag, an annotated
+  // one's tag object followed to the commit, through up to 8 tags of tags.
+  // Refused for a tag on anything but a commit.
+  getRepoTag(options: { repo: RepoName; tag: string }): Promise<{ tag: string; oid: string }>
+  // The repo's gzipped tarball at the full commit `sha`, whole, in memory:
+  // getRepoTreeTarball's for the tree GitHub names for that commit, asked
+  // on every call, cached or not. So its top directory is named for the
+  // tree, and files marked `export-subst` are as committed, not rewritten.
   getRepoTarball(options: { repo: RepoName; sha: string }): Promise<Uint8Array>
+  // The id of the tree at `directory`, `/`-separated as npm's is, in the
+  // full commit `sha`, or of its root without one: from the tree GitHub
+  // names for the commit, down GitHub's listings a directory at a time,
+  // each hashed back to its id. Refused where `directory` is none.
+  getRepoTreeId(options: { repo: RepoName; sha: string; directory?: string }): Promise<string>
+  // The gzipped tarball of a tree, the repo's own or any subdirectory's, by
+  // its id, whole, in memory: GitHub's, its files under one top directory.
+  // Its files are hashed back into git's tree and the id must be `tree`,
+  // whether downloaded or read from setCacheDir's cache (npm.js), where it
+  // is kept by the id alone, for good; a cached copy that does not match
+  // throws. A tarball shows a submodule as an empty directory, leaves out
+  // a subtree with no file in it, and has a file marked `eol=crlf` with
+  // CRLF where git has LF, as a checkout writes it: the submodule's commit,
+  // the subtrees and the blobs come from GitHub's listings of the trees,
+  // asked only then, cached or not, a CRLF file is taken only where the
+  // tree's .gitattributes have git write it so, and the id must still come
+  // out `tree`. The bytes are GitHub's: the tree as a checkout with no
+  // `core.autocrlf` writes it, the same for every repo. So GitHub's tarball
+  // is refused for a tree with files marked `export-ignore`, which it
+  // leaves out, or `ident`, `filter` or `working-tree-encoding` beside
+  // `eol=crlf`, or `eol=crlf` on a file git has with both CRLF and LF; for
+  // one with .gitattributes rules src/attributes.js does not read; and from
+  // a repo set to include Git LFS objects in archives, which replace the
+  // pointers git has; that repo still gets a tree already cached, pointers
+  // and all.
+  getRepoTreeTarball(options: { repo: RepoName; tree: string }): Promise<Uint8Array>
   // The repository's published security advisories, as GitHub's
-  // repository advisory objects. One page of 100: GitHub pages this list
-  // by cursor, so a repository with a full page is refused.
+  // repository advisory objects: every page of 100, each found by the
+  // cursor in the one before's Link header. More than 100 pages is an
+  // error.
   listRepoAdvisories(options: { repo: RepoName }): Promise<any[]>
+  // The entries of `directory` in the full commit `sha`, or of its root,
+  // found as getRepoTreeId finds it: GitHub's listing, hashed back to the
+  // tree's id, so none is left out or changed.
+  listRepoDir(options: { repo: RepoName; sha: string; directory?: string }): Promise<RepoDirEntry[]>
+  // Every page of the repo's tags, as GitHub lists them, each with the
+  // commit GitHub names for it, an annotated tag's included, which
+  // getRepoTag checks is one; more than `maxPages` (100 by default) pages
+  // of 100 is an error, as is a tag with no commit.
+  listRepoTags(options: { repo: RepoName; maxPages?: number }): Promise<{ tag: string; oid: string }[]>
   // Every page of `GET /user/repos`, as GitHub's repository objects; more
   // than `maxPages` (100 by default) pages of 100 is an error.
   listUserRepos(options?: { maxPages?: number }): Promise<any[]>

package/npm.d.ts

@@ -6,16 +6,39 @@
 // cache path, otherwise. Responses are read up to a size limit and within
 // a timeout, as github.d.ts describes, and lookups for many names go to
 // the registry eight at a time.
+//
+// Where NPM_TOKEN is set, it is sent with the requests for a scoped
+// package, so a private one can be read.
+
+// Where a program called `name` keeps its cache for this user, as each
+// platform has it, read from the environment when called. macOS:
+// ~/Library/Caches/<name>. Windows: %LOCALAPPDATA%\<name>\Cache, the
+// `Cache` apart from the program's other local data there. Elsewhere, the
+// XDG Base Directory spec's: $XDG_CACHE_HOME/<name>, or ~/.cache/<name>
+// where it is unset, empty or relative, which the spec has ignored.
+// Undefined where no absolute directory is found to start from: a home
+// directory that is relative, empty or unknown. Nothing is made. `name` is
+// 6 to 32 of a-z, A-Z, 0-9, `_` and `-`, so one directory name the same on
+// every platform.
+export function cacheDirFor(name: string): string | undefined
+
+// cacheDirFor('PreventiveMeasures'), read once, when this module is first
+// imported: where setCacheDir() caches.
+export const defaultCacheDir: string | undefined
 
-// Where cached answers live, resolved when set. Unset by default, and
-// unset means no cache: every read misses and every write is skipped.
+// Where cached answers are written and read, resolved when set: `dir`, or
+// defaultCacheDir where it is left out, which throws where there is none.
+// Unset until this is called, and unset again by `false`, which means no
+// cache: every read of it misses and every write is skipped. getTarball
+// reads ours all the same, set or not.
 //
 // The directory is trusted: a package's repo is answered from it as it
 // was written, with no request. Point it only at storage that nothing
 // less trusted than the caller can write, never a cache shared with or
-// restored from lower-trust jobs. Tarballs don't rely on this, since they
-// are checked against the registry's integrity on every call.
-export function setCacheDir(dir: string): void
+// restored from lower-trust jobs. Tarballs, crates (cargo.js), zips
+// (soldeer.js) and tree tarballs (github.js) don't rely on this, since
+// they are checked against their integrity on every call.
+export function setCacheDir(dir?: string | false): void
 
 // A failed request: `status` is the HTTP status the registry answered
 // with (404 for a package or version it does not have).
@@ -46,8 +69,11 @@ export interface PackageRepo {
 export function resolvePackageRepos(packageNames: Iterable<string>, options?: { cachedOnly?: boolean }): Promise<Map<string, PackageRepo>>
 
 // The disk cache resolvePackageRepos reads and writes, a month per entry.
-// A read answers null for anything but a usable entry; a write answers
-// false where it could not write, and never throws.
+// A read answers null for anything but a usable entry, one written by a
+// release that resolved repos by other rules included; a write answers
+// false where it could not write, and never throws. A write takes the
+// `github` a lookup gives, `owner/name` with no trailing `.git`, so what
+// it writes reads back.
 export function readPackageRepoCache(name: string): Promise<PackageRepo | null>
 export function writePackageRepoCache(name: string, github: string, directory?: string): Promise<boolean>
 
@@ -80,10 +106,11 @@ export function verifyDist(name: string, version: string, dist: Dist): Promise<v
 // for. Either way the bytes are checked against `dist.integrity`, whether
 // they were downloaded (before they are cached) or read from a cache.
 //
-// Other tools' caches are read first, and never written: npm's (cacache
-// under npm_config_cache, else npm's default, `~/.npm` outside Windows;
-// and npm 4's `<name>/<version>/package.tgz` there), then
-// `~/.audit/cache/tgz/<org>:<name>-<version>.tgz`. A file there that does
-// not match is passed over. One in setCacheDir's cache that does not
-// match throws.
+// Other caches are read first, and never written: npm's (cacache under
+// npm_config_cache, else npm's default, `~/.npm` outside Windows; and npm
+// 4's `<name>/<version>/package.tgz` there), then
+// `~/.audit/cache/tgz/<org>:<name>-<version>.tgz`, then defaultCacheDir
+// and cacheDirFor('stasis'), as setCacheDir files a tarball in either,
+// whether set or not. A file there that does not match is passed over.
+// Then setCacheDir's cache, where one that does not match throws.
 export function getTarball(name: string, version: string, dist?: Dist): Promise<Uint8Array>

package/npm.js

@@ -1,4 +1,4 @@
-export { setCacheDir } from './src/cache.js'
+export { cacheDirFor, defaultCacheDir, setCacheDir } from './src/cache.js'
 export { HttpError } from './src/http.js'
 export { getGitHub, readPackageRepoCache, resolvePackageRepos, writePackageRepoCache } from './src/npm/repos.js'
 export { getMeta, getTarball, verifyDist } from './src/npm/tarball.js'

package/package.d.ts

@@ -4,14 +4,14 @@ export interface PackageRepoLink {
   // `owner/name`, by GitHub's own rules.
   github?: string
   // Where in that repo the package sits, `/`-separated, as the tree path
-  // itself (a homepage URL's decoded); absent at its root, and whenever
-  // `github` is.
+  // itself (a homepage URL's decoded; a `repository.directory`'s `\` read
+  // as `/`); absent at its root, and whenever `github` is.
   directory?: string
   // `https://github.com/<github>`, whenever there is a `github`.
   url?: string
 }
 
-// Read off `bugs`, `repository` and `homepage`, in that order, from a
+// Read off `repository`, `bugs` and `homepage`, in that order, from a
 // package.json or the registry's document for a version of one. Both
 // fields absent where nothing in it names a GitHub repo; a throw only
 // for something that is not an object at all.