@preventive/upstream 1.0.0-alpha.5 → 1.0.0-alpha.6

package/npm.d.ts

@@ -6,6 +6,9 @@
 // cache path, otherwise. Responses are read up to a size limit and within
 // a timeout, as github.d.ts describes, and lookups for many names go to
 // the registry eight at a time.
+//
+// Where NPM_TOKEN is set, it is sent with the requests for a scoped
+// package, so a private one can be read.
 
 // Where cached answers live, resolved when set. Unset by default, and
 // unset means no cache: every read misses and every write is skipped.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/upstream",
-  "version": "1.0.0-alpha.5",
+  "version": "1.0.0-alpha.6",
   "description": "Minimal npm, crates.io and Soldeer registry clients, a GitHub client, and a git checkout reader: the calls we use, nothing more",
   "type": "module",
   "exports": {
@@ -78,6 +78,7 @@
     "src/github/read.js",
     "src/github/write.js",
     "src/http.js",
+    "src/npm/registry.js",
     "src/npm/repos.js",
     "src/npm/tarball.js",
     "src/package.js",

package/src/npm/registry.js

@@ -0,0 +1,19 @@
+import assert from 'node:assert/strict'
+
+import { show } from '../args.js'
+import { NPM_REGISTRY, buildUrl, request } from '../http.js'
+
+// Private packages are always scoped.
+export function withNpmToken(name, url, options = {}) {
+  const method = options.method ?? 'GET'
+  assert.ok(method === 'GET' && `${new URL(url)}` === url && url.startsWith(`${NPM_REGISTRY}/${name}/`), `Unexpected request for ${name}: ${method} ${url}`)
+  const token = process.env.NPM_TOKEN
+  return token && name.startsWith('@') ? { ...options, method, headers: { ...options.headers, Authorization: `Bearer ${token}` } } : options
+}
+
+export async function getDocument(method, name, spec) {
+  const url = buildUrl(NPM_REGISTRY, [...name.split('/'), spec])
+  const json = await request(url, withNpmToken(name, url, { as: 'json' }))
+  assert.ok(json?.name === name, `${method}: the registry answered for ${show(json?.name)}, not ${name}`)
+  return json
+}

package/src/npm/repos.js

@@ -1,20 +1,17 @@
 import assert from 'node:assert/strict'
 
-import { assertNames, assertPackageName, assertRepo, isRepo, show } from '../args.js'
+import { assertNames, assertPackageName, assertRepo, isRepo } from '../args.js'
 import { readRecord, writeRecord } from '../cache.js'
-import { NPM_REGISTRY, buildUrl, isNotFound, recover, request } from '../http.js'
+import { isNotFound, recover } from '../http.js'
 import { assertRepoDirectory, getRepo, isRepoDirectory } from '../package.js'
 import { pool } from '../pool.js'
+import { getDocument } from './registry.js'
 
 const DIR = 'npm/repos'
 const CONCURRENCY = 8
 
 // `latest`, not the full packument, which is megabytes of version history.
-async function fetchRepo(method, name) {
-  const json = await request(buildUrl(NPM_REGISTRY, [...name.split('/'), 'latest']), { as: 'json' })
-  assert.ok(json?.name === name, `${method}: the registry answered for ${show(json?.name)}, not ${name}`)
-  return getRepo(json)
-}
+const fetchRepo = async (method, name) => getRepo(await getDocument(method, name, 'latest'))
 
 export async function getGitHub(name) {
   assertPackageName('getGitHub', 'name', name)

package/src/npm/tarball.js

@@ -5,7 +5,8 @@ import { join, resolve } from 'node:path'
 
 import { assertArgs, assertPackage, assertion, matches, show } from '../args.js'
 import { verifiedDownload } from '../download.js'
-import { NPM_REGISTRY, buildUrl, request } from '../http.js'
+import { NPM_REGISTRY, buildUrl } from '../http.js'
+import { getDocument, withNpmToken } from './registry.js'
 
 const DIR = 'npm/tarballs' // No expiry: the registry never takes a version twice.
 // One sha512 and nothing else, as the registry writes it: a sha1, a second
@@ -29,8 +30,8 @@ function checkedDist(method, name, version, dist) {
 }
 
 async function getDist(method, name, version) {
-  const json = await request(buildUrl(NPM_REGISTRY, [...name.split('/'), version]), { as: 'json' })
-  assert.ok(json?.name === name && json.version === version, `${method}: the registry answered for ${show(json?.name)}@${show(json?.version)}, not ${name}@${version}`)
+  const json = await getDocument(method, name, version)
+  assert.ok(json.version === version, `${method}: the registry answered for ${name}@${show(json.version)}, not ${name}@${version}`)
   return checkedDist(method, name, version, { tarball: json.dist?.tarball, integrity: json.dist?.integrity })
 }
 
@@ -70,5 +71,5 @@ export async function verifyDist(name, version, dist) {
 export async function getTarball(name, version, dist) {
   assertPackage('getTarball', name, version)
   const { tarball, integrity } = dist === undefined ? await getDist('getTarball', name, version) : checkedDist('getTarball', name, version, dist)
-  return await verifiedDownload({ method: 'getTarball', dir: DIR, what: `${name}@${version}`, ext: 'tgz', algorithm: 'sha512', expected: integrity, local: localPaths(name, version, integrity), locate: () => tarball })
+  return await verifiedDownload({ method: 'getTarball', dir: DIR, what: `${name}@${version}`, ext: 'tgz', algorithm: 'sha512', expected: integrity, local: localPaths(name, version, integrity), locate: () => tarball, options: withNpmToken(name, tarball) })
 }