@preventive/upstream 1.0.0-alpha.12 → 1.0.0-alpha.13

package/npm.d.ts

@@ -7,8 +7,9 @@
 // a timeout, as github.d.ts describes, and lookups for many names go to
 // the registry eight at a time.
 //
-// Where NPM_TOKEN is set, it is sent with the requests for a scoped
-// package, so a private one can be read.
+// Where PREVENTIVE_MEASURES_NPM_TOKEN, STASIS_NPM_TOKEN or NPM_TOKEN is
+// set, the first of them not empty, in that order, is sent with the
+// requests for a scoped package, so a private one can be read.
 
 // Where a program called `name` keeps its cache for this user, as each
 // platform has it, read from the environment when called. macOS:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/upstream",
-  "version": "1.0.0-alpha.12",
+  "version": "1.0.0-alpha.13",
   "description": "Minimal npm, crates.io and Soldeer registry clients, a GitHub client, and a git checkout reader: the calls we use, nothing more",
   "type": "module",
   "exports": {

package/src/npm/registry.js

@@ -3,12 +3,15 @@ import assert from 'node:assert/strict'
 import { show } from '../args.js'
 import { NPM_REGISTRY, buildUrl, request } from '../http.js'
 
+// The first of these that is set and not empty.
+const npmToken = () => process.env.PREVENTIVE_MEASURES_NPM_TOKEN || process.env.STASIS_NPM_TOKEN || process.env.NPM_TOKEN
+
 // Private packages are always scoped.
 export function withNpmToken(name, url, options = {}) {
   const method = options.method ?? 'GET'
   const own = url === `${NPM_REGISTRY}/${name}` || url.startsWith(`${NPM_REGISTRY}/${name}/`)
   assert.ok(method === 'GET' && `${new URL(url)}` === url && own, `Unexpected request for ${name}: ${method} ${url}`)
-  const token = process.env.NPM_TOKEN
+  const token = npmToken()
   return token && name.startsWith('@') ? { ...options, method, headers: { ...options.headers, Authorization: `Bearer ${token}` } } : options
 }